Splunk Search

How to calculate a rolling percentage of growth between two values?

HCadmins
Communicator

I have a linechart with values that increase each day. Is there a way to calculate and display the percentage of growth?

In the screenshot provided there are two values, 166,294,515,189,537 and 167,520,605,713,749

Mathematically, we would just
Find the difference of the two numbers = 1226090524212
Divide that by the original number and multiply by 100, giving us = 0.7373.... so roughly .74%

But what I want is a rolling percentage increase

Is this even possible?

Please see screenshot.alt text

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving fields Time, Volume
| streamstats current=f window=1 values(Volume) as prev
| eval Change=round((Volume-prev)*100/prev,2) | fields - prev

Updated
Updating to full search per your question

eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval Volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | table Time Volume
| streamstats current=f window=1 values(Volume) as prev
| eval "Change%"=round((Volume-prev)*100/prev,2) | fields - prev

Above search will give both Volume and Change% field which can be charted. Please note that magnitude of Volume and "Change%" is not comparable (billions vs 2 digit number), so you wont see graph for "Change%" in the same chart, unless you use chart overlay.

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving fields Time, Volume
| streamstats current=f window=1 values(Volume) as prev
| eval Change=round((Volume-prev)*100/prev,2) | fields - prev

Updated
Updating to full search per your question

eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval Volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | table Time Volume
| streamstats current=f window=1 values(Volume) as prev
| eval "Change%"=round((Volume-prev)*100/prev,2) | fields - prev

Above search will give both Volume and Change% field which can be charted. Please note that magnitude of Volume and "Change%" is not comparable (billions vs 2 digit number), so you wont see graph for "Change%" in the same chart, unless you use chart overlay.

HCadmins
Communicator

Thanks,

Do I need to do the timechart command to get it to appear as a linechart? Adding your SPL doesn't give me a table or chart or anything. (forgive my ignorance.)

0 Karma

HCadmins
Communicator

eventtype=cv Entity="Data Size Backed Up in Last 7 Days" dailygrowth=* | eval volume=dailygrowth | eval Time=strftime(_time,"%m/%d/%y %I:%M %p") | streamstats current=f window=1 values(Volume) as prev | eval Change=round((Volume-prev)*100/prev,2) | fields - prev

0 Karma

somesoni2
Revered Legend

Add your current timechar search (ine that is seen in screenshot) before streamstats.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...