Splunk Search

Need help selecting values from two events and calculating percentage change

jmattheson
Engager

Hello,

First of all, thanks for any help you may be able to give me. I would appreciate some help with a problem I'm having. I uploaded a csv file to my Splunk that contains only Date/Value pairs. Below is an example of the data.

I would like to select the Value of 2020-07-31 and the value of 2020-06-30 and calculate the percentage change over that month. Additionally, I'd like to be able to calculate the percentage change but I think I may be able to get that on my own if I can get a hand with the first part.

I'd share my queries so far but I wasted the whole day yesterday trying to get this to work with little useful progress.

Untitled picture.png

 

Labels (3)
0 Karma
1 Solution

jmattheson
Engager

So, I decided to fix how I ingested the data in the first place to make the Date column the timestamp. I added TIMESTAMP_FIELDS and FIELD_FORMAT to the conf file. This greatly simplified my queries. This is probably the right solution for me instead of doing something wrong and then making a convoluted workaround. Thanks for the suggestion.

View solution in original post

0 Karma

vikasjha001
Engager

Below query shall give you output of your first question. You need to use where clause in your query. Do let me  know if you need more help. Hit a like answer was helpful.

index="blsi_cpi"|table Date, Value|where Date="2020-07-31" or Date="2020-06-30"

to4kawa
SplunkTrust
SplunkTrust
| gentimes start=01/31/2020 
| eval _time=starttime
| timechart span=1month count
| eval _time=relative_time(_time,"-1d@d")
| reverse
| eval Value=100
| streamstats count
| eval Value=Value+count*45
| fields - count
| rename COMMENT as "this is sample"

| rename COMMENT as "this is logic"
| reverse
| autoregress Value as last_Value
| reverse
| eval perc=round(Value/last_Value * 100,2)

You didn't provide a calculation method, so I'm not sure.

jmattheson
Engager

So, I decided to fix how I ingested the data in the first place to make the Date column the timestamp. I added TIMESTAMP_FIELDS and FIELD_FORMAT to the conf file. This greatly simplified my queries. This is probably the right solution for me instead of doing something wrong and then making a convoluted workaround. Thanks for the suggestion.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!