Developing for Splunk Enterprise

In splunk to find percentage difference for each column

pswalia06
Explorer

I need to find the difference between each date for each App_name in splunk

Right now my query just show the today number of record recieve each day per topic name/ Appname. I want to find out the percentage difference of record for each day from its previous day.

index="platform" sourcetype="logs" | rex "sent:\s(?\d+)\sfrom the file\s:\s(?[\w.\/_-]+)\s" | rex field=source ".(?[\w\/_-]+)." | timechart span=24h sum(record) as records by topic_name

Can someone help

Tags (1)

renjith_nair
SplunkTrust
SplunkTrust

@pswalia06,

Try this

index="platform" sourcetype="logs" | rex "sent:\s(?\d+)\sfrom the file\s:\s(?[\w.\/_-]+)\s" | rex field=source ".(?[\w\/_-]+)." 
|timechart span=24h sum(record) as records by topic_name
|untable _time,topic_name,records|sort topic_name,_time
|streamstats last(records) as prev_records  current=f window=1 reset_on_change=true by topic_name|fillnull value=0
|eval perc=((records-prev_records  )/records)*100|fields - records,prev_records  |xyseries _time,sourcetype,perc
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.