Splunk Search

How to use the timechart command to find percentage differences between months by severity?

cbrownlee
New Member

I am trying to run a report that runs percentages differences from month to month for each of the severities. I have no idea where to start.

| timechart count by Severity

 Critical   Major   Minor   Warning

2016-01 2300 502 1703 6821
2016-02 4133 401 1608 7721
2016-03 3767 737 1178 1473
2016-04 3875 4279 770 16541

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your base search | bucket span=1mon _time | stats count by Severity _time 
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | bucket span=1mon _time | stats count by Severity _time 
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity
0 Karma

sundareshr
Legend

Try this

base search | timechart count by Severity | delta Major as Major_d | delta Minor as Minor_d | delta Warning as Warning_d | eval perc_Major=round((Major-Major_d)/Major*100, 2) | eval perc_Minor=round((Minor -Minor_d)/Minor*100, 2) | eval perc_Warning=round((Warning-Warning_d)/Warning*100, 2)
0 Karma

cbrownlee
New Member

This one the percent doesnt come out right. Am I seeing that correct?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...