Percentage change in event counts

[mcamilleri]

I need to calculate the percentage increase/decrease in the number of events in the last 5 minutes compared to the previous 5 minutes. So I think I need something like this:

(stats count <query A> - stats count <query B>) / stats count <query B>

I wasn't able to create a query that works - is it possible to achieve this in Splunk?

[alacercogitatus · Accepted solution]

I initially went the same way as sdaniels, but found that when spanning across 10 minutes, I sometimes got 3 results from the bin, since it snaps to 0 or 5 intervals. So I did this:

`earliest=-5m@m latest=@m your_search |eval Report="Second"| append [search earliest=-10m@m latest=-5m@m your_search | eval _time = _time + 300 | eval Report="First"] | stats sum(eval(if(match(Report,"First"),1,0))) as First sum(eval(if(match(Report,"Second"),1,0))) as Second count as Total | eval DiffPercent = (First - Second) / First * 100`

[mcamilleri]

Related question here: http://answers.splunk.com/answers/113865/percentage-difference-in-results
Been trying to apply same query to another problem unsuccessfully so far.

[mcamilleri]

works great, thanks!

[sdaniels]

You can certainly do this in Splunk. Something like this:

sourcetype="your sourcetype" | bucket _time span=5m | stats count as myEventCount by _time | delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100

This should give you a table with the numbers you are looking for and then you can do whatever you want with it from there.

If you want to reverse it, add a sort on _time and now the latest time will be on the top.

sourcetype="access_combined" | bucket _time span=5m | stats count as myEventCount by _time | sort -_time|  delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100