Dashboards & Visualizations

How do you calculate values in 2 panels to create a 3rd?

rwarnerii
New Member

I have the following search:
alt text

which produces the following results:
alt text

I have created a dashboard panel with this information. I'd like to do a month over month comparison, so I have created a second panel with the same search. The first panel time frame is set to search the month of September, and the second the month of October. I would like calculate the percentage change for each Threat Category and display the results in a 3rd panel.

How would I go about accessing the count values in the panel to use in the calculation? Or is it even possible?

Thanks!

0 Karma

laurie_gellatly
Communicator

Taking from :https://answers.splunk.com/answers/185455/how-to-create-a-month-over-month-year-over-year-re.html and modifying it you could do something like:

index=zscaler urlsupercat="Advanced Security" earliest=-2month@month latest=-1month@month 
| stats count as pre_month by urlcat  
| join urlcat [ index=zscaler urlsupercat="Advanced Security" earliest=-1month@month latest=@month |  stats count as this_month by urlcat ]
| eval month_perc=100*(this_month / pre_month) 
| rename urlcat as "Threat Category"
| table month_perc,"Threat Category"

....
You could start by creating a base search that does the combined period (remember to keep _time and just the fields you need)

HTH ...Laurie:{)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...