Splunk Search

## Percentage change in event counts

Path Finder

I need to calculate the percentage increase/decrease in the number of events in the last 5 minutes compared to the previous 5 minutes. So I think I need something like this:

``````(stats count <query A> - stats count <query B>) / stats count <query B>
``````

I wasn't able to create a query that works - is it possible to achieve this in Splunk?

Tags (4)
1 Solution
SplunkTrust

I initially went the same way as sdaniels, but found that when spanning across 10 minutes, I sometimes got 3 results from the bin, since it snaps to 0 or 5 intervals. So I did this:

```````earliest=-5m@m latest=@m your_search |eval Report="Second"| append [search earliest=-10m@m latest=-5m@m your_search | eval _time = _time + 300 | eval Report="First"] | stats sum(eval(if(match(Report,"First"),1,0))) as First sum(eval(if(match(Report,"Second"),1,0))) as Second count as Total | eval DiffPercent = (First - Second) / First * 100`
``````
SplunkTrust

I initially went the same way as sdaniels, but found that when spanning across 10 minutes, I sometimes got 3 results from the bin, since it snaps to 0 or 5 intervals. So I did this:

```````earliest=-5m@m latest=@m your_search |eval Report="Second"| append [search earliest=-10m@m latest=-5m@m your_search | eval _time = _time + 300 | eval Report="First"] | stats sum(eval(if(match(Report,"First"),1,0))) as First sum(eval(if(match(Report,"Second"),1,0))) as Second count as Total | eval DiffPercent = (First - Second) / First * 100`
``````
Path Finder

Been trying to apply same query to another problem unsuccessfully so far.

Path Finder

works great, thanks!

Splunk Employee

You can certainly do this in Splunk. Something like this:

``````sourcetype="your sourcetype" | bucket _time span=5m | stats count as myEventCount by _time | delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100
``````

This should give you a table with the numbers you are looking for and then you can do whatever you want with it from there.

If you want to reverse it, add a sort on _time and now the latest time will be on the top.

``````sourcetype="access_combined" | bucket _time span=5m | stats count as myEventCount by _time | sort -_time|  delta myEventCount as change | eval perc_change = change/(myEventCount-change)*100
``````