Splunk Search

How can I sort results for previous week and current week in two seperate columns?

wanda619
Path Finder

Hi Folks,

How can i display the results for 2022-09-02 in Result_Prev column and 2022-09-09 in Result column and keeping the other columns same. Calculating Percent difference from a this week to the previous week results. 

wanda619_0-1662734632865.png

any help is appreciated. Thank you !

 

Labels (5)
0 Karma

wanda619
Path Finder

@yuanliu I am having this error when I am trying to use the above code: 

wanda619_0-1663174726748.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@wanda619 My mistake.  Should be -0w@w.

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

 

0 Karma

wanda619
Path Finder

@yuanliu when i try to search itby the above code you mentioned, I did not get the errors i needed as it is blanking and giving 0 outputs on results column.

wanda619_0-1663686699861.png

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If "Results" column is 0, that means count in the first stats command is also 0, i.e., if you run

* earliest=-2w@w latest=-0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time

count should all be zero.  Can you confirm that?  Maybe there's some spelling error?  Does the main search return anything?

0 Karma

wanda619
Path Finder

@yuanliu The data is collected daliy as there are daily transactions and the error are shown daily 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You didn't specify how frequently data is collected, so I'll assume that they can be aggregated into as a weekly stats by something like earliest=-2w@w latest=0w@w.  With this assumption, you can do

* earliest=-2w@w latest=0w@w
| bin span=1w@w _time
| stats count by CustomerName Error _time
| stats earliest(count) as ResultPrev latest(count) as Result max(_time) as _time by CustomerName Error
| eventstats sum(Result) as "Percent of Total"
| eval "Percent Difference" = round((Result - ResultPrev)/ResultPrev * 100, 2), "Percent of Total" = round(Result / 'Percent of Total' * 100, 2)

Of course, replace "*" with your real search.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...