Splunk Search

How to calculate percentage deviation



I have logs which looks similar to the sample data attached. In my current scenario I have 30 days hourly data for each of the 9 nodes i.e., "msc "and 303 KPIs i.e., "never" in the sample log. I want to calculate the %deviation of the KPIs i.e., never_* for the latest day from the average of last 30 days. I could calculate the deviation with the below logic but unable to structure the logic to calculate the %deviation. Kindly suggest if my logic is correct to calculate deviation:

index=<indexname> | stats avg(never_*) as avg_* latest(never_*) as values_* by date_hour, msc | foreach values_* [eval deviation_<<MATCHSTR>>=abs(avg_<<MATCHSTR>>-<<FIELD>>] | table date_hour msc deviation_* | stats avg(deviation_*) as avg_dev_* by msc | eval total_avg_dev=0 | foreach avg_dev_* [eval total_avg_dev=<<FIELD>>+total_avg_dev] | eval avg_avg_dev=total_avg_dev/303 | table msc avg_avg_dev | sort - avg_avg_dev | rename avg_avg_dev as deviation | head 10

If this correct then, how should I calculate the percentage deviation in this case?


Try This:

| stats avg(never*) AS avg_never* latest(never*) AS current_never* by hour, msc_name
| foreach current_* [eval pct_deviation_<<MATCHSTR>>=abs(<<FIELD>>-avg_<<MATCHSTR>>)*100/avg_<<MATCHSTR>>]
| table hour msc_name pct_deviation_*
| stats avg(pct_deviation_*) AS avg_pctdeviation_* by msc_name | addtotals| eval avg=Total/5 | fields msc_name avg
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!