How to create a report that shows percentage change with successful logins per day?

[bluescape360]

new splunk user: trying to create a report that shows percentage change with successful logins per day

example: i have a field that shows successful logins, but there are several records in a day, so I do bucket _time span=1d. put all the records in one total number count. How can I show the change for the next day?

day 1 : 60 successful login
day 2: 100 successful login
day 3: 30 successful login

there is a 60% change from day 1 to day2, How can I chart that change? show a percentage?

[Suda]

Hello,

Could you try to use "streamstats" command?

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Streamstats

This is my example search command.

index=_internal sourcetype=splunkd_access
| timechart span=1d count
| streamstats sum(count) AS prev current=f window=1
| eval count / prev * 100 - 100
| table _time count ratio

I hope it helps you.

Happy splunking!

[moiezuddin]

How to find out the no of users who had not login per day