Splunk Search

## Comparing information based on _time and calculated value

Explorer

I have looked for solutions but I have mostly found results regarding only current and past time comparison which is not what I need.

I have a query that bins _time by 24h spans over the previous 7 days. and calculates a numeric value associated with those time spans. What I need is to compare each day's values to the entire week's and find any time period (so 48h) where the number jumped significantly.

An example of something similar to my my code:

index=sandwiches saved_search_name="yum" earliest=-7d
| bin span=24h _time
| search sandwich_type="PB&J"
| stats count by total_bread_type _time

currently the results are like this:

 _time bread 2021-12-22 18:00 22 2021-12-23 18:00 23 2021-12-24 18:00 21 2021-12-25 18:00 47 2021-12-26 18:00 48 2021-12-27 18:00 46 2021-12-28 18:00 47

Basically I am looking to compare the 'bread' values by _time and figure out if/where there is a jump of 10 or more and return that data.

Any insight would be appreciated. Thanks!

Labels (1)
• ### other

Tags (1)
1 Solution
SplunkTrust

Try this.  The streamstats command takes the difference between adjacent results then we filter for a jump of more than 10.

``````index=sandwiches saved_search_name="yum" earliest=-7d
| bin span=24h _time
| search sandwich_type="PB&J"
| stats count by total_bread_type _time
| streamstats window=2 range(bread) as diff
| where diff > 10``````
---
If this reply helps you, Karma would be appreciated.
SplunkTrust

Try this.  The streamstats command takes the difference between adjacent results then we filter for a jump of more than 10.

``````index=sandwiches saved_search_name="yum" earliest=-7d
| bin span=24h _time
| search sandwich_type="PB&J"
| stats count by total_bread_type _time
| streamstats window=2 range(bread) as diff
| where diff > 10``````
---
If this reply helps you, Karma would be appreciated.
Explorer

That did the trick! Thank you so much Rich.

Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...