Splunk Search

## How to write a search to compare and find the difference between monthly results over a period of time?

Builder

We have the below splunk query to get the availability report. How to compare monthly availability results? Example: the month of October availability percentage is 99% and November is 95%. How to get the variation difference. can you please provide the query to show the variation of results between months or over the period.

index="idxweblog" c=cnbc | eval Count5xx=if(status like "5%",1,0) | stats sum(Count5xx) as Count5xx count(status) as Total | eval AvailablePercentage=(Total - Count5xx)*100/Total | table AvailablePercentage

Tags (4)
1 Solution
Legend

You could try

``````index="idxweblog" c=cnbc
| eval month = strftime(_time,"%m")
| eval Count5xx=if(status like "5%",1,0)
| stats sum(Count5xx) as Count5xx count(status) as Total by month
| eval AvailablePercentage=(Total - Count5xx)*100/Total
| delta AvailablePercentage as Difference
``````
Legend

You could try

``````index="idxweblog" c=cnbc
| eval month = strftime(_time,"%m")
| eval Count5xx=if(status like "5%",1,0)
| stats sum(Count5xx) as Count5xx count(status) as Total by month
| eval AvailablePercentage=(Total - Count5xx)*100/Total
| delta AvailablePercentage as Difference
``````
Motivator

Have you looked at the "delta" command?

Builder

can you provide some sample?

State of Splunk Careers