Splunk Search

How to calculate the difference of two searches

salavilli0611
New Member

Following is my splunk search :

index=main  "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h
| eval  DBCount =if(_time>relative_time(now(),"-15m") , "CurrentCount","PreviousCount") 
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100

| append [search "rest/bi/applicationStatus" Action_Response_Time>1
| eval  DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount") 
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100]

Kindly refer to my attachment, I would like to know how I can get the diff in percentage between 2 searches.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

index=main "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h
| eval DBCount =if(_time>relative_time(now(),"-15m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100

| append [search "rest/bi/applicationStatus" Action_Response_Time>1
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100]
| eval slowincreasepercent=round(slowincreasepercent,2)."%"

---
If this reply helps you, Karma would be appreciated.
0 Karma

salavilli0611
New Member

| eval slowincreasepercent = round(((CurrentCount-PreviousCount)/PreviousCount)*100),2)."%"] not working

Error received :
Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

0 Karma

salavilli0611
New Member

| append [search "rest/bi/applicationStatus" Action_Response_Time>200
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent = round(((CurrentCount-PreviousCount)/PreviousCount)*100),2)."%"]

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try my new answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

salavilli0611
New Member

Getting Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

tried with this as suggested :

index=main "rest/bi/applicationStatus" Action_Response_Time>1 earliest=-1h
| eval DBCount =if(_time>relative_time(now(),"-15m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent=((CurrentCount-PreviousCount)/PreviousCount)*100

| append [search "rest/bi/applicationStatus" Action_Response_Time>1
| eval DBCount =if(_time>relative_time(now(),"-45m") , "CurrentCount","PreviousCount")
| chart count over Action_Name by DBCount | eval slowincreasepercent = round(((CurrentCount-PreviousCount)/PreviousCount)*100),2)."%"]

0 Karma

salavilli0611
New Member

The result I will be getting 2 events - field percentage in row1 and row2
what I want to know , how to diff the field of percentage ( Please refer to my screen for more visibility )

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...