Splunk Search

How can I sort results for previous week and current week in two seperate columns?

wanda619
Path Finder

Hi Folks,

How can i display the results for 2022-09-02 in Result_Prev column and 2022-09-09 in Result column and keeping the other columns same. Calculating Percent difference from a this week to the previous week results. 

wanda619_0-1662734632865.png

any help is appreciated. Thank you !

 

Labels (5)
0 Karma

wanda619
Path Finder

@yuanliu I am having this error when I am trying to use the above code: 

wanda619_0-1663174726748.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@wanda619 My mistake.  Should be -0w@w.

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

 

0 Karma

wanda619
Path Finder

@yuanliu when i try to search itby the above code you mentioned, I did not get the errors i needed as it is blanking and giving 0 outputs on results column.

wanda619_0-1663686699861.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If "Results" column is 0, that means count in the first stats command is also 0, i.e., if you run

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time

count should all be zero.  Can you confirm that?  Maybe there's some spelling error?  Does the main search return anything?

0 Karma

wanda619
Path Finder

@yuanliu The data is collected daliy as there are daily transactions and the error are shown daily 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You didn't specify how frequently data is collected, so I'll assume that they can be aggregated into as a weekly stats by something like earliest=-2w@w latest=0w@w.  With this assumption, you can do

* earliest=-2w@w latest=0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

Of course, replace "*" with your real search.

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...