Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Day to day % Difference
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi guys,
I create daily reports with various data on that we collect, and i am now looking to add a few extra bits of information that will be useful to the team.
I am looking to create a chart that show the % difference from the today's data against the data received the day before. For example if we received 100 events yesterday and 200 today it shows an increase of 100%. Any help would be very much appreciated.
Cheers,
Allan
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally, streamstats should be used for this (depending upon what is your current search). However, delta can be used if you query is a simple scenario like a timechart being plotted for daily span. The delta command will give you the difference of count in the current row with previous row. This way you will have a way to identify what was the previous day's total. See the following run anywhere search based on Splunk's _internal index.
index=_internal sourcetype="splunkd" log_level="WARN"
| timechart span=1d count
| delta count as Delta
| fillnull value=0 Delta
| eval Total=count-Delta
| eval percIncrDecr=(Delta/Total)*100
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ideally, streamstats should be used for this (depending upon what is your current search). However, delta can be used if you query is a simple scenario like a timechart being plotted for daily span. The delta command will give you the difference of count in the current row with previous row. This way you will have a way to identify what was the previous day's total. See the following run anywhere search based on Splunk's _internal index.
index=_internal sourcetype="splunkd" log_level="WARN"
| timechart span=1d count
| delta count as Delta
| fillnull value=0 Delta
| eval Total=count-Delta
| eval percIncrDecr=(Delta/Total)*100
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This works, thank you so much!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great Cheers!!! 🙂
| makeresults | eval message= "Happy Splunking!!!"
Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA
.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...
A Season of Skills: New Splunk Courses to Light Up Your Learning Journey
