Splunk Search

How can I compare sum(bytes) in two time period using sub-search?

everynameIwanti
Explorer

Hi. im new to Splunk.

I'm trying to compare the sum(bytes) for an hour ago, and the same hour one week before by certain field, and calculate the percentage change for these data. I have tried the following code, but the sum(bytes) it gives for doesn't match the actual value.

index=xxx earliest=-60m latest=now | stats sum(bytes) as current by abc | appendcols [search index=xxx earliest=-1h@h-1w latest=@h-1w  | stats sum(bytes) as before by abc] | eval diff=current-before | eval percentagediff=round(abs(diff/before)*100,0) 

The problem is that the current and the before values it returns are really off the actual value it should be at that time.
May you guys please give me some ideas or suggestions of where could this go wrong?
Thank you

Tags (2)
0 Karma

horsefez
Motivator

@everynameIwantistaken,

Try something like this with your timerange settings.

for the Subsearch do earliest=-169h@h latest=-168h@h

0 Karma

everynameIwanti
Explorer

it didn't work. I think is more like the search for the past even where out of place, like same event from last week can have 10times the sum(bytes) than the current values.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...