Splunk Enterprise

Custom query

Santosh2
Path Finder

from the below query,  i am running for 2 to 3 and posted the output and ran again same query from 3 to 4 and posted the output.
i want a query where i can compare pervious hour(2 to 3 data) with (3 to 4) data  and i want to calculate the difference percentage 

|mstats sum(transaction) as Trans where index=host-metrics service=login application IN(app1, app2, app3, app4) span=1h by application

output:

02:00 to 03:00 hours data

_timeapplicationTrans
2022-01-22 02:00

app1

3456.000000
2022-01-22 02:00app25632.000000
2022-01-22 02:00app35643.000000
2022-01-22 02:00app416543.00000

 

03:00 to 04:00 hours data output:

_timeapplicationTrans
2022-01-22 03:00app18753.000000
2022-01-22 03:00app2342.000000
2022-01-22 03:00app387653.000000
2022-01-22 03:00app4

8912.00000

Labels (2)
0 Karma

Santosh2
Path Finder

can anyone help on this??

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...