Splunk Search

Diff and % calculation 1st row vs 2nd row

puneethgowda
Communicator

alt text

source=DAM_DB_SUMMARY_REPORT | eval Date=substr(DATES,1,10) | stats sum(TOTAL_RECORDS) as "Total Records" by Date | sort - Date

i would like to insert one column that should be DIFF and calculation should be subtraction ( Row 1 - row 2) row 1 value us 797,775 and row 2 value is 797,774 so 3rd new column value should be 1. and also we need % in 3rd column 1/797,775 (diff/1st row count)

Tags (1)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I thought this for sure was going to be a streamstats answer, but instead it's far easier to use delta.

You should be able to just add | delta "Total Records" to the end of your search, like

source=DAM_DB_SUMMARY_REPORT | eval Date=substr(DATES,1,10) | stats sum(TOTAL_RECORDS) as "Total Records" by Date | sort - Date | delta "Total Records"

Can you give that a go and report back?

Happy Splunking!
Rich

View solution in original post

Richfez
SplunkTrust
SplunkTrust

I thought this for sure was going to be a streamstats answer, but instead it's far easier to use delta.

You should be able to just add | delta "Total Records" to the end of your search, like

source=DAM_DB_SUMMARY_REPORT | eval Date=substr(DATES,1,10) | stats sum(TOTAL_RECORDS) as "Total Records" by Date | sort - Date | delta "Total Records"

Can you give that a go and report back?

Happy Splunking!
Rich

puneethgowda
Communicator

thanks a lot

0 Karma

puneethgowda
Communicator

sorry it was very simple i have got this after posting here forgot to upfdate

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...