Splunk Search

Difference between count of events grouped by host and path for 2 last 10m time ranges

Haleb
Path Finder

I have the following SPL search.

 

index="cloudflare"
| top ClientRequestPath by ClientRequestHost
| eval percent = round(percent,2)
| rename count as "Events", ClientRequestPath as "Path", percent as "%"

 

 Wich give me this result. I also need to group it by 10m time range and calculate the difference in percents between 2 previous time ranges for every line. Help me figure out how do that, thx.
Screenshot 2024-02-09 153030.png

Labels (3)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You may need to go back to basics to get your time buckets it. Start with something like this

index="cloudflare"
| bin _time span=10m
| stats count by _time ClientRequestHost ClientRequestPath
| eventstats sum(count) as total by _time ClientRequestHost
| eval percent = round(count / total,2)
| rename count as "Events", ClientRequestPath as "Path", percent as "%"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You may need to go back to basics to get your time buckets it. Start with something like this

index="cloudflare"
| bin _time span=10m
| stats count by _time ClientRequestHost ClientRequestPath
| eventstats sum(count) as total by _time ClientRequestHost
| eval percent = round(count / total,2)
| rename count as "Events", ClientRequestPath as "Path", percent as "%"
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...