How to use the timechart command to find percentage differences between months by severity?

[cbrownlee]

I am trying to run a report that runs percentages differences from month to month for each of the severities. I have no idea where to start.

| timechart count by Severity

 Critical   Major   Minor   Warning

2016-01 2300 502 1703 6821
2016-02 4133 401 1608 7721
2016-03 3767 737 1178 1473
2016-04 3875 4279 770 16541

[somesoni2 · Accepted solution]

Try something like this

your base search | bucket span=1mon _time | stats count by Severity _time 
| streamstats current=f window=1 values(count) as prevcount by Severity
| eval Perc=if(isnull(prevcount),0,round((count-prevcount)*100/prevcount,2)
| timechart span=1mon max(Perc) by Severity

[sundareshr]

Try this

base search | timechart count by Severity | delta Major as Major_d | delta Minor as Minor_d | delta Warning as Warning_d | eval perc_Major=round((Major-Major_d)/Major*100, 2) | eval perc_Minor=round((Minor -Minor_d)/Minor*100, 2) | eval perc_Warning=round((Warning-Warning_d)/Warning*100, 2)

[cbrownlee]

This one the percent doesnt come out right. Am I seeing that correct?