Splunk Search

How to compare the values of dynamic column?

sarvesh_11
Communicator

Hello Splunkers,

My search executes monthly, over a period of 3 months data, since march is going on my last 3 months would be Dec, Jan and Feb. Now in the Trend column, i need the difference of Previous 2 months by Priority.

As the month succeeds, the column name would also change.

 

sarvesh_11_2-1615551327619.png

 

Also, can i show the difference with pictorial view?

Like for High, it should be downward arrow as percentage decreased by 3, for Medium it should be linear arrow, for Low it should be upward arrow, as it increased by 1%.

Thanks in Advance for your time 🙂

Cheers,

 

Labels (3)
0 Karma
1 Solution

to4kawa
Ultra Champion

....
| streamstats window=2 first(eval(rtrim(Percent,"%"))) as p_perc by Priority
| eval trend=rtrim(Percent,"%") - p_perc
| eventstats last(trend) as Trend by Priority
| eval Priority=Priority."_".Trend
| xyseries Priority month Percent
| rex field=Priority "(?<Priority>.*)_(?<Trend>.*)"

 There is only the image data, so I haven't tried it.

 

 

View solution in original post

0 Karma

to4kawa
Ultra Champion

Incorrect query.
Aggregate by stats, not by timechart
If you use autoregress and eval, you should be fine.

0 Karma

sarvesh_11
Communicator

@to4kawa 

i have to use chart, because the desired format is snap what i shared.

do we have functionality like to compare the values of column wrt column number?

using stats looks like:

sarvesh_11_0-1615787911991.png

 

0 Karma

to4kawa
Ultra Champion

....
| streamstats window=2 first(eval(rtrim(Percent,"%"))) as p_perc by Priority
| eval trend=rtrim(Percent,"%") - p_perc
| eventstats last(trend) as Trend by Priority
| eval Priority=Priority."_".Trend
| xyseries Priority month Percent
| rex field=Priority "(?<Priority>.*)_(?<Trend>.*)"

 There is only the image data, so I haven't tried it.

 

 

0 Karma

sarvesh_11
Communicator

Hey @to4kawa ,
Just last thing, sorting doesn't happens with xyseries?

M unable to sort this:

sarvesh_11_0-1615979882599.png

It should come Dec-2020 Jan-2021 Feb-2021.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...