Splunk Search

Calculate percentage increase/reduction

superisk
Explorer

Hello,

I have calculated my Total Escalations per Quarter using stats count and I would like to include another field to calculate the percentage increase/decrease of Total Escalations per Quarter.

My query -

| inputlookup Case_Database_v2.csv
| rename "Case Number" AS Case_Number
| search Role=Support Squad=*CMS*
| lookup EAS_Escalations_v1.csv "Case Number" AS Case_Number OUTPUTNEW "Case Number"
| rename "Case Number" AS EAS_Case_Number
| eventstats dc(Case_Number) as CaseCount by Quarter
| stats count(EAS_Case_Number) as Total_Escalations by Quarter, CaseCount
| eval EAS_Escalation(Percentage)=round(Distinct_Escalations/CaseCount*100,2)

 

And this shows -

 

   
QuarterCaseCountTotal Escalations
Qtr 1799315
Qtr 2889368
Qtr 3798287
Qtr 4777220

 

I would like to calculate the percentage reduction per quarter, for example,  Qtr 4 Total Escalations of 220 is a 13.5% reduction on the 287 escalations from Qtr 3.

Any help is much appreciated!

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Streamstats should do it.

| inputlookup Case_Database_v2.csv
| rename "Case Number" AS Case_Number
| search Role=Support Squad=*CMS*
| lookup EAS_Escalations_v1.csv "Case Number" AS Case_Number OUTPUTNEW "Case Number"
| rename "Case Number" AS EAS_Case_Number
| eventstats dc(Case_Number) as CaseCount by Quarter
| stats count(EAS_Case_Number) as Total_Escalations by Quarter, CaseCount
| eval EAS_Escalation(Percentage)=round(Distinct_Escalations/CaseCount*100,2)
| streamstats window=2 range(Total_Escalations) as Diff
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Streamstats should do it.

| inputlookup Case_Database_v2.csv
| rename "Case Number" AS Case_Number
| search Role=Support Squad=*CMS*
| lookup EAS_Escalations_v1.csv "Case Number" AS Case_Number OUTPUTNEW "Case Number"
| rename "Case Number" AS EAS_Case_Number
| eventstats dc(Case_Number) as CaseCount by Quarter
| stats count(EAS_Case_Number) as Total_Escalations by Quarter, CaseCount
| eval EAS_Escalation(Percentage)=round(Distinct_Escalations/CaseCount*100,2)
| streamstats window=2 range(Total_Escalations) as Diff
---
If this reply helps you, Karma would be appreciated.

superisk
Explorer

Thank you kindly!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...