Splunk Search

Calculate total count difference per day

Sfry1981
Communicator

I have a set of data like the below

total=2000
date=2020-04-29

total=1975
date=2020-04-28

total=1951
date=2020-04-27

What I want to produce is a chart that shows the difference per day of these totals i.e as per the below

total difference = 25
date=2020-04-29

total difference=24
date=2020-04-28

total=33
date=2020-04-27

etc

I need a calculation of the difference per day

my raw data already has the total and date in so its a straight calculation from that data

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Sfry1981

Can you please try this?

YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff

Sample Search:

| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff

Just change search as per your requirement.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Sfry1981

Can you please try this?

YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff

Sample Search:

| makeresults | eval  total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff

Just change search as per your requirement.

Sfry1981
Communicator

@kamlesh_vaghela

As the date was in a string format i removed "eval t=strptime(date,"%Y-%m-%d")" and then it worked. Thanks 🙂

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

cool @Sfry1981

Glad to help you

0 Karma

Sfry1981
Communicator

@kamlesh_vaghela i have 1 issue. It shows all the previous figures as minus so it inverts the graphs but i want them to show as positives. I tried "| eval mynum=abs(mynum)" but this doesnt work. Do you know how to amend?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Sfry1981

| eval mynum=abs(mynum) should work.

Try:
|makeresults count=10 | eval a=-1 | accum a |eval mynum=a | eval mynum=abs(mynum)

Can you please share your sample search and sample value you getting in mynum?

0 Karma

Sfry1981
Communicator

sorry @kamlesh_vaghela It was my mistake, where i was charting i was using the incorrect value. School boy error. All working again. Thanks for all your help.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...