Dashboards & Visualizations

How do you calculate values in 2 panels to create a 3rd?

rwarnerii
New Member

I have the following search:
alt text

which produces the following results:
alt text

I have created a dashboard panel with this information. I'd like to do a month over month comparison, so I have created a second panel with the same search. The first panel time frame is set to search the month of September, and the second the month of October. I would like calculate the percentage change for each Threat Category and display the results in a 3rd panel.

How would I go about accessing the count values in the panel to use in the calculation? Or is it even possible?

Thanks!

0 Karma

laurie_gellatly
Communicator

Taking from :https://answers.splunk.com/answers/185455/how-to-create-a-month-over-month-year-over-year-re.html and modifying it you could do something like:

index=zscaler urlsupercat="Advanced Security" earliest=-2month@month latest=-1month@month 
| stats count as pre_month by urlcat  
| join urlcat [ index=zscaler urlsupercat="Advanced Security" earliest=-1month@month latest=@month |  stats count as this_month by urlcat ]
| eval month_perc=100*(this_month / pre_month) 
| rename urlcat as "Threat Category"
| table month_perc,"Threat Category"

....
You could start by creating a base search that does the combined period (remember to keep _time and just the fields you need)

HTH ...Laurie:{)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...