I have a linechart with values that increase each day. Is there a way to calculate and display the percentage of growth?
In the screenshot provided there are two values, 166,294,515,189,537 and 167,520,605,713,749
Mathematically, we would just
Find the difference of the two numbers = 1226090524212
Divide that by the original number and multiply by 100, giving us = 0.7373.... so roughly .74%
But what I want is a rolling percentage increase
Is this even possible?
Please see screenshot.
Try something like this
your current search giving fields Time, Volume
| streamstats current=f window=1 values(Volume) as prev
| eval Change=round((Volume-prev)*100/prev,2) | fields - prev
Updated
Updating to full search per your question
eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval Volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | table Time Volume
| streamstats current=f window=1 values(Volume) as prev
| eval "Change%"=round((Volume-prev)*100/prev,2) | fields - prev
Above search will give both Volume and Change% field which can be charted. Please note that magnitude of Volume and "Change%" is not comparable (billions vs 2 digit number), so you wont see graph for "Change%" in the same chart, unless you use chart overlay.
Try something like this
your current search giving fields Time, Volume
| streamstats current=f window=1 values(Volume) as prev
| eval Change=round((Volume-prev)*100/prev,2) | fields - prev
Updated
Updating to full search per your question
eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval Volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | table Time Volume
| streamstats current=f window=1 values(Volume) as prev
| eval "Change%"=round((Volume-prev)*100/prev,2) | fields - prev
Above search will give both Volume and Change% field which can be charted. Please note that magnitude of Volume and "Change%" is not comparable (billions vs 2 digit number), so you wont see graph for "Change%" in the same chart, unless you use chart overlay.
Thanks,
Do I need to do the timechart
command to get it to appear as a linechart? Adding your SPL doesn't give me a table or chart or anything. (forgive my ignorance.)
eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | streamstats current=f window=1 values(Volume) as prev | eval Change=round((Volume-prev)*100/prev,2) | fields - prev
Add your current timechar search (ine that is seen in screenshot) before streamstats.