Splunk Search

How to compare current month count to a 3 months average?


Hello Splunkers.


i need your help in creating a search that would count number of values for a field in a month and then compare it to a 3months average of the same results.



Labels (3)
0 Karma


Hi @msalghamdi,

only one question,: do you want to calculate the count for the current month or the last 30 days or the previous month?

because if the current month you have an incomplete count, I suppose that you want the last complete month count compared with the three months before count.

so please try this:

index=your_index earliest=-mon@mon latest=@mon
| stats count AS "Current month"
| append [ search 
   index=your_index earliest=-4mon@mon latest=-3mon@mon
   | stats count AS "Three months ago" ]
| table "Current month" "Three months ago"
| eval Diff="Three months ago"-"Current month"



0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...