Splunk Search

How to write a search to compare and find the difference between monthly results over a period of time?

Builder

We have the below splunk query to get the availability report. How to compare monthly availability results? Example: the month of October availability percentage is 99% and November is 95%. How to get the variation difference. can you please provide the query to show the variation of results between months or over the period.

index="idxweblog" c=cnbc | eval Count5xx=if(status like "5%",1,0) | stats sum(Count5xx) as Count5xx count(status) as Total | eval AvailablePercentage=(Total - Count5xx)*100/Total | table AvailablePercentage

1 Solution

Legend

You could try

index="idxweblog" c=cnbc 
| eval month = strftime(_time,"%m")
| eval Count5xx=if(status like "5%",1,0) 
| stats sum(Count5xx) as Count5xx count(status) as Total by month
| eval AvailablePercentage=(Total - Count5xx)*100/Total 
| delta AvailablePercentage as Difference

View solution in original post

Legend

You could try

index="idxweblog" c=cnbc 
| eval month = strftime(_time,"%m")
| eval Count5xx=if(status like "5%",1,0) 
| stats sum(Count5xx) as Count5xx count(status) as Total by month
| eval AvailablePercentage=(Total - Count5xx)*100/Total 
| delta AvailablePercentage as Difference

View solution in original post

Motivator

Have you looked at the "delta" command?

0 Karma

Builder

can you provide some sample?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!