Splunk Enterprise

Custom query

Santosh2
Path Finder

from the below query,  i am running for 2 to 3 and posted the output and ran again same query from 3 to 4 and posted the output.
i want a query where i can compare pervious hour(2 to 3 data) with (3 to 4) data  and i want to calculate the difference percentage 

|mstats sum(transaction) as Trans where index=host-metrics service=login application IN(app1, app2, app3, app4) span=1h by application

output:

02:00 to 03:00 hours data

_timeapplicationTrans
2022-01-22 02:00

app1

3456.000000
2022-01-22 02:00app25632.000000
2022-01-22 02:00app35643.000000
2022-01-22 02:00app416543.00000

 

03:00 to 04:00 hours data output:

_timeapplicationTrans
2022-01-22 03:00app18753.000000
2022-01-22 03:00app2342.000000
2022-01-22 03:00app387653.000000
2022-01-22 03:00app4

8912.00000

Labels (2)
0 Karma

Santosh2
Path Finder

can anyone help on this??

0 Karma
Get Updates on the Splunk Community!

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...