To show the difference for two values in timechart Splunk

[Raja_Selvaraj]

Hi Everyone,

Can someone please help me with Splunk query to show difference of two values in timechart for the period of time. The sample result which i get from the query with Column A with time range and other columns with the respective host values.

Column A Column B Column C Column D

02/22/2025  10         12               14
02/23/2025   11         13               15

02/24/2025   12         15               17 
02/25/2025    16         20              21

I need the difference of values of Column B C D from previous time period and show it one time chart. Let me know if any other details are required.

[gcusello]

Hi @Raja_Selvaraj ,

use delta command ( https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Delta ).

<your_search>
| timechart span=1d count BY column
| delta columnA AS new_columnA
| delta columnB AS new_columnC
| delta columnC AS new_columnC
| eval 
     deltaA=new_columnA-columnA,
     deltaB=new_columnB-columnB,
     deltaC=new_columnC-columnC

Ciao.

Giuseppe

[Raja_Selvaraj]

Hello Giuseppe,

Thanks for the reply, but when my data looks like this (shared in screenshot) and how do we compare difference with current date values & previous date values for each host values and show it as timechart series:-

my query ends with:-

| timechart span=1d avg(File_Total) by HOST

[gcusello]

Hi @Raja_Selvaraj ,

if you know the names of the host you can follow my solution.

Cisao.

Giuseppe

[Raja_Selvaraj]

Hi @gcusello ,

There are many host names like more than 80 host names from the mentioned search results. 

[gcusello]

Hi @Raja_Selvaraj ,

if you have more than 80 columns, how do you think that you can read 80 columns of values plus 80 columnd of differences from the previous values, it's anyway unreadable!

Maybe you should think a different visualization!

Anyway, you could use something like this:

<your_search>
| bin span=1d _time
| stats count BY host _time
| delta count AS previous_count
| delta host AS previous_host
| where host=previous_host
| eval deltaA=previous_count-count

Ciao.

Giuseppe