Splunk Search
Highlighted

Percentage change in event counts

Path Finder

I need to calculate the percentage increase/decrease in the number of events in the last 5 minutes compared to the previous 5 minutes. So I think I need something like this:

(stats count <query A> - stats count <query B>) / stats count <query B>

I wasn't able to create a query that works - is it possible to achieve this in Splunk?

Highlighted

Re: Percentage change in event counts

Splunk Employee
Splunk Employee

You can certainly do this in Splunk. Something like this:

sourcetype="your sourcetype" | bucket _time span=5m | stats count as myEventCount by _time | delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100

This should give you a table with the numbers you are looking for and then you can do whatever you want with it from there.

If you want to reverse it, add a sort on _time and now the latest time will be on the top.

sourcetype="access_combined" | bucket _time span=5m | stats count as myEventCount by _time | sort -_time|  delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100
Highlighted

Re: Percentage change in event counts

SplunkTrust
SplunkTrust

I initially went the same way as sdaniels, but found that when spanning across 10 minutes, I sometimes got 3 results from the bin, since it snaps to 0 or 5 intervals. So I did this:

`earliest=-5m@m latest=@m your_search |eval Report="Second"| append [search earliest=-10m@m latest=-5m@m your_search | eval _time = _time + 300 | eval Report="First"] | stats sum(eval(if(match(Report,"First"),1,0))) as First sum(eval(if(match(Report,"Second"),1,0))) as Second count as Total | eval DiffPercent = (First - Second) / First * 100`

View solution in original post

Highlighted

Re: Percentage change in event counts

Path Finder

works great, thanks!

0 Karma
Highlighted

Re: Percentage change in event counts

Path Finder

Related question here: http://answers.splunk.com/answers/113865/percentage-difference-in-results
Been trying to apply same query to another problem unsuccessfully so far.

0 Karma