hello
I use the search below in order to calculate a percentage
But I need to add + if s > s2 and - if s2 < s
How to do this please?
`index` sourcetype="session"
| bin _time span=15m
| eval time=strftime(_time,"%H:%M")
| stats dc(s) as s by time
| table s
| appendcols
[ search `index` sourcetype="session" earliest=-7d@d+7h latest=-7d@d+19h
| bin _time span=15m
| eval time=strftime(_time,"%H:%M")
| stats dc(s) as s2 by time
| table s2]
| eval perc=round((s/s2)*100,1). "%"
| table perc
i @jip31,
I suppose that the problem is the plus (+) mark because the minus (-) mark is always inserted in the eval calculation.
Anyway, you could modify your eval command in this way:
| eval perc=if(s>s2,"+","").round((s/s2)*100,1)."%"
Ciao.
Giuseppe
if s > s2 is the same as if s2 < s
i @jip31,
I suppose that the problem is the plus (+) mark because the minus (-) mark is always inserted in the eval calculation.
Anyway, you could modify your eval command in this way:
| eval perc=if(s>s2,"+","").round((s/s2)*100,1)."%"
Ciao.
Giuseppe
Hi Gcusello
thanks
Hi @jip31,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the Contributors 😉