How to add + or - before a percentage?

[jip31]

hello

I use the search below in order to calculate a percentage

But I need to add + if s > s2 and - if s2 < s

How to do this please?

`index` sourcetype="session" 
| bin _time span=15m 
| eval time=strftime(_time,"%H:%M") 
| stats dc(s) as s by time 
| table s
| appendcols 
    [ search `index` sourcetype="session" earliest=-7d@d+7h latest=-7d@d+19h 
    | bin _time span=15m 
    | eval time=strftime(_time,"%H:%M") 
    | stats dc(s) as s2 by time  
    | table s2] 
| eval perc=round((s/s2)*100,1). "%" 
| table perc

[ITWhisperer]

if s > s2 is the same as if s2 < s

[gcusello · Accepted solution]

i @jip31,

I suppose that the problem is the plus (+)  mark because the minus (-) mark is always inserted in the eval calculation.

Anyway, you could modify your eval command in this way:

| eval perc=if(s>s2,"+","").round((s/s2)*100,1)."%"

Ciao.

Giuseppe

[jip31]

Hi Gcusello

thanks

[gcusello]

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉