Splunk Search

How to calculate the percentage change over a month based on delta?

hqw
Path Finder

hi all,

I want a new column which calculates the percentage change over a month. In the below snapshot, the change rate should equal to the diff/sum of last month. One example is percentage=41703/299981.
however, if I add a new command behind :|eval percentage=round(dif/sum,1), it will calculate by 41703/341684, which is not correct.

could any one help me out of this?

thanks in advance.

alt text

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Replace your delta with this:

... | streamstats current=f window=1 last(sum) as last_sum | eval dif = sum - last_sum | eval percentage = round(dif/last_sum, 1)

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Replace your delta with this:

... | streamstats current=f window=1 last(sum) as last_sum | eval dif = sum - last_sum | eval percentage = round(dif/last_sum, 1)
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...