Splunk Search

How to calculate the percentage change over a month based on delta?

hqw
Path Finder

hi all,

I want a new column which calculates the percentage change over a month. In the below snapshot, the change rate should equal to the diff/sum of last month. One example is percentage=41703/299981.
however, if I add a new command behind :|eval percentage=round(dif/sum,1), it will calculate by 41703/341684, which is not correct.

could any one help me out of this?

thanks in advance.

alt text

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Replace your delta with this:

... | streamstats current=f window=1 last(sum) as last_sum | eval dif = sum - last_sum | eval percentage = round(dif/last_sum, 1)

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Replace your delta with this:

... | streamstats current=f window=1 last(sum) as last_sum | eval dif = sum - last_sum | eval percentage = round(dif/last_sum, 1)
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...