Splunk Search

How to calculate percentage deviation

MousumiChowdhur
Contributor

Hi,

I have logs which looks similar to the sample data attached. In my current scenario I have 30 days hourly data for each of the 9 nodes i.e., "msc "and 303 KPIs i.e., "never" in the sample log. I want to calculate the %deviation of the KPIs i.e., never_* for the latest day from the average of last 30 days. I could calculate the deviation with the below logic but unable to structure the logic to calculate the %deviation. Kindly suggest if my logic is correct to calculate deviation:

index=<indexname> | stats avg(never_*) as avg_* latest(never_*) as values_* by date_hour, msc | foreach values_* [eval deviation_<<MATCHSTR>>=abs(avg_<<MATCHSTR>>-<<FIELD>>] | table date_hour msc deviation_* | stats avg(deviation_*) as avg_dev_* by msc | eval total_avg_dev=0 | foreach avg_dev_* [eval total_avg_dev=<<FIELD>>+total_avg_dev] | eval avg_avg_dev=total_avg_dev/303 | table msc avg_avg_dev | sort - avg_avg_dev | rename avg_avg_dev as deviation | head 10

If this correct then, how should I calculate the percentage deviation in this case?

mayurr98
Super Champion

Try This:

index=<your_index>
| stats avg(never*) AS avg_never* latest(never*) AS current_never* by hour, msc_name
| foreach current_* [eval pct_deviation_<<MATCHSTR>>=abs(<<FIELD>>-avg_<<MATCHSTR>>)*100/avg_<<MATCHSTR>>]
| table hour msc_name pct_deviation_*
| stats avg(pct_deviation_*) AS avg_pctdeviation_* by msc_name | addtotals| eval avg=Total/5 | fields msc_name avg
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...