Splunk Search
Highlighted

How do I make a search that compares weekly values and shows the percentage difference between fields?

Communicator

Hi,

I would like to compare 1 week of tabled data to the previous weeks and calculate the percentage difference for each field value for field note_label

Initial search:

 search... | stats count by note_label

 note_label      count
 abc                   10
 abcd           20
 abcde          30

I would like to show the data as:

note_label      count (week1)  count(week2)   %Change
 abc                   10          20                   100%
 abcd                 20          5                     -75%
 abcde          40             60                    50%

I may be following the wrong route as i tried this but had no luck, and may need to use a different method? This search only give me the "note_label" field value names, but not the values.

 earliest=-1w latest=now my_search | stats earliest(note_label) as e_status_label latest(note_label) as l_note_label  | eval 1w=(l_note_label-e_note_label)/e_note_label*100
 | appendcols [ search earliest=-2w latest=now my_search | stats earliest(note_label) as e_note_label latest(note_label) as l_note_label  | eval 2w=(l_note_label-e_note_label)/e_note_label*100 ]
 | fields note_label 1w 2w

thanks

0 Karma
Highlighted

Re: How do I make a search that compares weekly values and shows the percentage difference between fields?

Communicator

I managed to figure it out in the end. I stuck with appendcols and changed my search with eval to calculate the percentage differences;

earliest=-1w latest=now MYSEARCH | rename count AS count_this_week status_label AS Supression_status
| appendcols
[ search earliest=-2w latest=-1w
MYSEARCH | rename count AS countlastweek statuslabel AS Supressionstatus] | eval change= ((countthisweek - countlastweek)/countthisweek)*100 | eval change=round(change,2) | eval change= change+ " %"|fields Supressionstatus, countthisweek, countlast_week, change

View solution in original post

0 Karma