- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to calculate the difference of two searche...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to calculate the difference of two searches
Following is my splunk search :
index=main "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h
| eval DBCount =if(_time>relative_time(now(),"-15m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100
| append [search "rest/bi/applicationStatus" Action_Response_Time>1
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100]
Kindly refer to my attachment, I would like to know how I can get the diff in percentage between 2 searches.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this:
index=main "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h
| eval DBCount =if(_time>relative_time(now(),"-15m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100
| append [search "rest/bi/applicationStatus" Action_Response_Time>1
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100]
| eval slowincreasepercent=round(slowincreasepercent,2)."%"
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| eval slowincreasepercent = round(((CurrentCount-PreviousCount)/PreviousCount)*100),2)."%"] not working
Error received :
Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| append [search "rest/bi/applicationStatus" Action_Response_Time>200
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent = round(((CurrentCount-PreviousCount)/PreviousCount)*100),2)."%"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try my new answer.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.
tried with this as suggested :
index=main "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h
| eval DBCount =if(_time>relative_time(now(),"-15m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100
| append [search "rest/bi/applicationStatus" Action_Response_Time>1
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent = round(((CurrentCount-PreviousCount)/PreviousCount)*100),2)."%"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The result I will be getting 2 events - field percentage in row1 and row2
what I want to know , how to diff the field of percentage ( Please refer to my screen for more visibility )
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
