I have a set of data like the below
total=2000
date=2020-04-29
total=1975
date=2020-04-28
total=1951
date=2020-04-27
What I want to produce is a chart that shows the difference per day of these totals i.e as per the below
total difference = 25
date=2020-04-29
total difference=24
date=2020-04-28
total=33
date=2020-04-27
etc
I need a calculation of the difference per day
my raw data already has the total and date in so its a straight calculation from that data
@Sfry1981
Can you please try this?
YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
Sample Search:
| makeresults | eval total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
Just change search as per your requirement.
@Sfry1981
Can you please try this?
YOUR_SEARCH | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
Sample Search:
| makeresults | eval total=2000, date="2020-04-29"
| append [ | makeresults | eval total=1975,date="2020-04-28"]
| append [ | makeresults | eval total=1951, date="2020-04-27"] | eval t=strptime(date,"%Y-%m-%d") | sort t | streamstats window=2 first(total) as p | eval diff=total-p | table date total diff
Just change search as per your requirement.
@kamlesh_vaghela
As the date was in a string format i removed "eval t=strptime(date,"%Y-%m-%d")" and then it worked. Thanks 🙂
cool @Sfry1981
Glad to help you
@kamlesh_vaghela i have 1 issue. It shows all the previous figures as minus so it inverts the graphs but i want them to show as positives. I tried "| eval mynum=abs(mynum)" but this doesnt work. Do you know how to amend?
@Sfry1981
| eval mynum=abs(mynum)
should work.
Try:
|makeresults count=10 | eval a=-1 | accum a |eval mynum=a | eval mynum=abs(mynum)
Can you please share your sample search and sample value you getting in mynum
?
sorry @kamlesh_vaghela It was my mistake, where i was charting i was using the incorrect value. School boy error. All working again. Thanks for all your help.