Splunk Search

## Calculate total count difference per day

Communicator

I have a set of data like the below

total=2000
date=2020-04-29

total=1975
date=2020-04-28

total=1951
date=2020-04-27

What I want to produce is a chart that shows the difference per day of these totals i.e as per the below

total difference = 25
date=2020-04-29

total difference=24
date=2020-04-28

total=33
date=2020-04-27

etc

I need a calculation of the difference per day

my raw data already has the total and date in so its a straight calculation from that data

Tags (2)
1 Solution
SplunkTrust

@Sfry1981

Can you please try this?

``````YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Sample Search:

``````| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Just change search as per your requirement.

SplunkTrust

@Sfry1981

Can you please try this?

``````YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Sample Search:

``````| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
``````

Just change search as per your requirement.

Communicator

@kamlesh_vaghela

As the date was in a string format i removed "eval t=strptime(date,"%Y-%m-%d")" and then it worked. Thanks 🙂

SplunkTrust

cool @Sfry1981

Communicator

@kamlesh_vaghela i have 1 issue. It shows all the previous figures as minus so it inverts the graphs but i want them to show as positives. I tried "| eval mynum=abs(mynum)" but this doesnt work. Do you know how to amend?

SplunkTrust

@Sfry1981

`| eval mynum=abs(mynum)` should work.

Try:
`|makeresults count=10 | eval a=-1 | accum a |eval mynum=a | eval mynum=abs(mynum)`

Can you please share your sample search and sample value you getting in `mynum`?

Communicator

sorry @kamlesh_vaghela It was my mistake, where i was charting i was using the incorrect value. School boy error. All working again. Thanks for all your help.

Get Updates on the Splunk Community!

#### Adoption of RUM and APM at Splunk

Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

#### March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

#### Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...