How to edit my search to find percentage deviation between two values for each platform?

[shaileshmali]

How do I find % deviation between 2 values for each platform? I am able to get deviation, but when i want deviation only for each platform, I do not want values for one platform compared with another platform. Is this possible in Splunk?

Current search:

index="test" OR index="test" Api=* (EventStreamData.eventName="5000027") 
| bucket _time span=15m 
| rename EventStreamData.response.userStatusCode{} as userStatusCode1 | rename EventStreamData.args.customerLoginRequest.signInPlatform as signInPlatform1
| eval PLATFORM=if((Api_Key="SICAPP" AND signInPlatform="Card"),"COS",if((Api_Key="SICAPP" AND signInPlatform="ENTERPRISE"),"EASE Web", if((Api_Key="SICAPP" AND signInPlatform="OLBank"), "OLBR",))
| eval SuccessVolume=if(DISPOSITION="SUCCESS",1,0) 
| eval PolicyVolume=if(DISPOSITION="POLICY",1,0) 
| eval DefectVolume=if(DISPOSITION="DEFECT",1,0)
| stats sum(SuccessVolume) as Success avg(SuccessVolume) as avg by _time,PLATFORM | sort PLATFORM
| fillnull 
| delta avg as change 
| fillnull
| eval change_percent=round(change/avg*100,0)

[somesoni2]

Give this a try

index="test" OR index="test" Api=* (EventStreamData.eventName="5000027") 
| bucket _time span=15m 
| rename EventStreamData.response.userStatusCode{} as userStatusCode1 | rename EventStreamData.args.customerLoginRequest.signInPlatform as signInPlatform1
| eval PLATFORM=if((Api_Key="SICAPP" AND signInPlatform="Card"),"COS",if((Api_Key="SICAPP" AND signInPlatform="ENTERPRISE"),"EASE Web", if((Api_Key="SICAPP" AND signInPlatform="OLBank"), "OLBR",))
| eval SuccessVolume=if(DISPOSITION="SUCCESS",1,0) 
| eval PolicyVolume=if(DISPOSITION="POLICY",1,0) 
| eval DefectVolume=if(DISPOSITION="DEFECT",1,0)
| stats sum(SuccessVolume) as Success avg(SuccessVolume) as avg by PLATFORM _time 
| streamstats current=f window=1 values(avg) as change by PLATFORM
| eval change=avg-change | eval change_percent=round(change/avg*100,0)