Reporting

Leaderboard report

ianmaddox4bookr
Explorer

I'd like to build a leaderboard style report. I want to show the top 100 items in a list and have a column that shows the delta compared to this same time last week. Is there a plugin or some other report that makes this possible?

Tags (3)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count

Modify to fit your data and desired output.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

index=_internal earliest=-1w@d latest=@d | top source | join source [search index=_internal earliest=-2w@d latest=-1w@d | top source | rename count as previous_count percent as previous_percent] | eval delta = count - previous_count

Modify to fit your data and desired output.

ianmaddox4bookr
Explorer

Thanks! That was definitely the right approach. I massaged it a bit to give a delta of rankings:

sourcetype=search earliest=-1d@d latest=@d | top search_query limit=100 | eval rank = 1 | accum rank | join search_query [search sourcetype=search earliest=-2d@d latest=-1d@d | top search_query limit=500 | eval prev_rank = 1 | accum prev_rank | rename count as prev_count percent as prev_percent] | eval delta = "+" . (prev_rank - rank) | replace "+-" with "-" in delta | replace "+0" with "--" in delta | table delta search_query count percent

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...