Splunk Search

How to calculate the percentage increase (or decrease) in each error/success code based on previous hour?

onthakur
Explorer

Team, 

I have below timechart which is counting http error/success codes for a span of 1hr.

Now I need to calculate the percentage increase (or decrease) in each error/success code based on previous hour.

_time 200 4xx errors 5xx errors
2022-05-23 00:00 100 20 30
2022-05-23 01:00 200 30 30
2022-05-23 02:00 250 50 60
2022-05-23 03:00 300 30 50
2022-05-23 04:00 350 40 40
2022-05-23 05:00 400 60 60
2022-05-23 06:00 500 80 80
Labels (1)
0 Karma

somesoni2
Revered Legend

Try this generic search (will work with any status)

Your current search with timechart
| streamstats current=f window=1 values(*) as prev_*
| foreach prev_* [| eval "PercChange_<<MATCHSTR>>" =round(('<<MATCHSTR>>'-'<<FIELD>>')*100/'<<FIELD>>',2)]
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| streamstats current=f window=1 latest('200') as previous_200 latest('4xx errors') as previous_4xx_errors latest('5xx errors') as previous_5xx_errors
| eval 200increase = 100 * '200' / previous_200 - 100
| eval 4xxincrease = 100 * '4xx errors' / previous_4xx_errors - 100
| eval 5xxincrease = 100 * '5xx errors' / previous_5xx_errors - 100
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...