Splunk Search

How to use the timechart command to find percentage differences between months by severity?

cbrownlee
New Member

I am trying to run a report that runs percentages differences from month to month for each of the severities. I have no idea where to start.

| timechart count by Severity

 Critical   Major   Minor   Warning

2016-01 2300 502 1703 6821
2016-02 4133 401 1608 7721
2016-03 3767 737 1178 1473
2016-04 3875 4279 770 16541

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your base search | bucket span=1mon _time | stats count by Severity _time 
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

your base search | bucket span=1mon _time | stats count by Severity _time 
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity
0 Karma

sundareshr
Legend

Try this

base search | timechart count by Severity | delta Major as Major_d | delta Minor as Minor_d | delta Warning as Warning_d | eval perc_Major=round((Major-Major_d)/Major*100, 2) | eval perc_Minor=round((Minor -Minor_d)/Minor*100, 2) | eval perc_Warning=round((Warning-Warning_d)/Warning*100, 2)
0 Karma

cbrownlee
New Member

This one the percent doesnt come out right. Am I seeing that correct?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...