I need to calculate the percentage increase/decrease in the number of events in the last 5 minutes compared to the previous 5 minutes. So I think I need something like this:
(stats count <query A> - stats count <query B>) / stats count <query B>
I wasn't able to create a query that works - is it possible to achieve this in Splunk?
I initially went the same way as sdaniels, but found that when spanning across 10 minutes, I sometimes got 3 results from the bin, since it snaps to 0 or 5 intervals. So I did this:
`earliest=-5m@m latest=@m your_search |eval Report="Second"| append [search earliest=-10m@m latest=-5m@m your_search | eval _time = _time + 300 | eval Report="First"] | stats sum(eval(if(match(Report,"First"),1,0))) as First sum(eval(if(match(Report,"Second"),1,0))) as Second count as Total | eval DiffPercent = (First - Second) / First * 100`
I initially went the same way as sdaniels, but found that when spanning across 10 minutes, I sometimes got 3 results from the bin, since it snaps to 0 or 5 intervals. So I did this:
`earliest=-5m@m latest=@m your_search |eval Report="Second"| append [search earliest=-10m@m latest=-5m@m your_search | eval _time = _time + 300 | eval Report="First"] | stats sum(eval(if(match(Report,"First"),1,0))) as First sum(eval(if(match(Report,"Second"),1,0))) as Second count as Total | eval DiffPercent = (First - Second) / First * 100`
Related question here: http://answers.splunk.com/answers/113865/percentage-difference-in-results
Been trying to apply same query to another problem unsuccessfully so far.
works great, thanks!
You can certainly do this in Splunk. Something like this:
sourcetype="your sourcetype" | bucket _time span=5m | stats count as myEventCount by _time | delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100
This should give you a table with the numbers you are looking for and then you can do whatever you want with it from there.
If you want to reverse it, add a sort on _time and now the latest time will be on the top.
sourcetype="access_combined" | bucket _time span=5m | stats count as myEventCount by _time | sort -_time| delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100