Splunk Search

How can I sort results for previous week and current week in two seperate columns?

wanda619
Path Finder

Hi Folks,

How can i display the results for 2022-09-02 in Result_Prev column and 2022-09-09 in Result column and keeping the other columns same. Calculating Percent difference from a this week to the previous week results. 

wanda619_0-1662734632865.png

any help is appreciated. Thank you !

 

Labels (5)
0 Karma

wanda619
Path Finder

@yuanliu I am having this error when I am trying to use the above code: 

wanda619_0-1663174726748.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@wanda619 My mistake.  Should be -0w@w.

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

 

0 Karma

wanda619
Path Finder

@yuanliu when i try to search itby the above code you mentioned, I did not get the errors i needed as it is blanking and giving 0 outputs on results column.

wanda619_0-1663686699861.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If "Results" column is 0, that means count in the first stats command is also 0, i.e., if you run

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time

count should all be zero.  Can you confirm that?  Maybe there's some spelling error?  Does the main search return anything?

0 Karma

wanda619
Path Finder

@yuanliu The data is collected daliy as there are daily transactions and the error are shown daily 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You didn't specify how frequently data is collected, so I'll assume that they can be aggregated into as a weekly stats by something like earliest=-2w@w latest=0w@w.  With this assumption, you can do

* earliest=-2w@w latest=0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

Of course, replace "*" with your real search.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...