Splunk Search

I want to calculate a difference between count columns and want to project the growth in the number of messages each mon

dhruvin24
New Member

dhruvin24_0-1627919474904.png

Here's my query and I want to calculate the difference between count (_raw) each month . It would be a running column so next month it would include the August month and then September and so on.. Can anyone please provide me solution to it ?

Labels (1)
0 Karma

dhruvin24
New Member

Thanks for the help.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

 

| stats count as current by date_month
| streamstats values(current) as previous window=1 current=f
| eval diff=current-previous

 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...