Splunk Search

Need help selecting values from two events and calculating percentage change

jmattheson
Engager

Hello,

First of all, thanks for any help you may be able to give me. I would appreciate some help with a problem I'm having. I uploaded a csv file to my Splunk that contains only Date/Value pairs. Below is an example of the data.

I would like to select the Value of 2020-07-31 and the value of 2020-06-30 and calculate the percentage change over that month. Additionally, I'd like to be able to calculate the percentage change but I think I may be able to get that on my own if I can get a hand with the first part.

I'd share my queries so far but I wasted the whole day yesterday trying to get this to work with little useful progress.

Untitled picture.png

 

Labels (3)
0 Karma
1 Solution

jmattheson
Engager

So, I decided to fix how I ingested the data in the first place to make the Date column the timestamp. I added TIMESTAMP_FIELDS and FIELD_FORMAT to the conf file. This greatly simplified my queries. This is probably the right solution for me instead of doing something wrong and then making a convoluted workaround. Thanks for the suggestion.

View solution in original post

0 Karma

vikasjha001
Engager

Below query shall give you output of your first question. You need to use where clause in your query. Do let me  know if you need more help. Hit a like answer was helpful.

index="blsi_cpi"|table Date, Value|where Date="2020-07-31" or Date="2020-06-30"

to4kawa
Ultra Champion
| gentimes start=01/31/2020 
| eval _time=starttime
| timechart span=1month count
| eval _time=relative_time(_time,"-1d@d")
| reverse
| eval Value=100
| streamstats count
| eval Value=Value+count*45
| fields - count
| rename COMMENT as "this is sample"

| rename COMMENT as "this is logic"
| reverse
| autoregress Value as last_Value
| reverse
| eval perc=round(Value/last_Value * 100,2)

You didn't provide a calculation method, so I'm not sure.

jmattheson
Engager

So, I decided to fix how I ingested the data in the first place to make the Date column the timestamp. I added TIMESTAMP_FIELDS and FIELD_FORMAT to the conf file. This greatly simplified my queries. This is probably the right solution for me instead of doing something wrong and then making a convoluted workaround. Thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...