Splunk Search

How can I sort results for previous week and current week in two seperate columns?

wanda619
Path Finder

Hi Folks,

How can i display the results for 2022-09-02 in Result_Prev column and 2022-09-09 in Result column and keeping the other columns same. Calculating Percent difference from a this week to the previous week results. 

wanda619_0-1662734632865.png

any help is appreciated. Thank you !

 

Labels (5)
0 Karma

wanda619
Path Finder

@yuanliu I am having this error when I am trying to use the above code: 

wanda619_0-1663174726748.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@wanda619 My mistake.  Should be -0w@w.

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

 

0 Karma

wanda619
Path Finder

@yuanliu when i try to search itby the above code you mentioned, I did not get the errors i needed as it is blanking and giving 0 outputs on results column.

wanda619_0-1663686699861.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If "Results" column is 0, that means count in the first stats command is also 0, i.e., if you run

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time

count should all be zero.  Can you confirm that?  Maybe there's some spelling error?  Does the main search return anything?

0 Karma

wanda619
Path Finder

@yuanliu The data is collected daliy as there are daily transactions and the error are shown daily 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You didn't specify how frequently data is collected, so I'll assume that they can be aggregated into as a weekly stats by something like earliest=-2w@w latest=0w@w.  With this assumption, you can do

* earliest=-2w@w latest=0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

Of course, replace "*" with your real search.

Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...