I am trying to run a report that runs percentages differences from month to month for each of the severities. I have no idea where to start.
| timechart count by Severity
Critical Major Minor Warning
2016-01 2300 502 1703 6821
2016-02 4133 401 1608 7721
2016-03 3767 737 1178 1473
2016-04 3875 4279 770 16541
Try something like this
your base search | bucket span=1mon _time | stats count by Severity _time
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity
Try something like this
your base search | bucket span=1mon _time | stats count by Severity _time
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity
Try this
base search | timechart count by Severity | delta Major as Major_d | delta Minor as Minor_d | delta Warning as Warning_d | eval perc_Major=round((Major-Major_d)/Major*100, 2) | eval perc_Minor=round((Minor -Minor_d)/Minor*100, 2) | eval perc_Warning=round((Warning-Warning_d)/Warning*100, 2)
This one the percent doesnt come out right. Am I seeing that correct?