Splunk Search

## Calculate total count difference per day

Communicator

I have a set of data like the below

total=2000
date=2020-04-29

total=1975
date=2020-04-28

total=1951
date=2020-04-27

What I want to produce is a chart that shows the difference per day of these totals i.e as per the below

total difference = 25
date=2020-04-29

total difference=24
date=2020-04-28

total=33
date=2020-04-27

etc

I need a calculation of the difference per day

my raw data already has the total and date in so its a straight calculation from that data

Tags (2)
1 Solution
SplunkTrust

@Sfry1981

``````YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Sample Search:

``````| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Just change search as per your requirement.

SplunkTrust

@Sfry1981

``````YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Sample Search:

``````| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Just change search as per your requirement.

Communicator

@kamlesh_vaghela

As the date was in a string format i removed "eval t=strptime(date,"%Y-%m-%d")" and then it worked. Thanks 🙂

SplunkTrust

cool @Sfry1981

Communicator

@kamlesh_vaghela i have 1 issue. It shows all the previous figures as minus so it inverts the graphs but i want them to show as positives. I tried "| eval mynum=abs(mynum)" but this doesnt work. Do you know how to amend?

SplunkTrust

@Sfry1981

`| eval mynum=abs(mynum)` should work.

Try:
`|makeresults count=10 | eval a=-1 | accum a |eval mynum=a | eval mynum=abs(mynum)`

Can you please share your sample search and sample value you getting in `mynum`?

Communicator

sorry @kamlesh_vaghela It was my mistake, where i was charting i was using the incorrect value. School boy error. All working again. Thanks for all your help.

Get Updates on the Splunk Community!

#### Autoscaling Kubernetes Workloads with Splunk

About What if you had the ability to scale your Kubernetes pods as a result of information output from Splunk? ...

#### Discover SplunkTrust and MVP Articles, Instant Translation, and More on Splunk ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

#### Integrating Kubernetes and Splunk Observability Cloud

We need end-to-end insight into our application environments to confidently ensure everything is up and ...