Splunk Search

chart count for comparison

selvam_sekar
Path Finder

Hi,

I have the below SPL and I am not able to get the expected results. Please could you help?

if i use stats count by - then i'm not getting the expected result as below.

SPL:

basesearch earliest=@d latest=now
| append
[ search earliest=-1d@d latest=-1d]
| eval Consumer = case(match(File_Name,"^ABC"), "Down", match(File_Name,"^csd"),"UP", match(File_Name,"^CSD"),"UP",1==1,"Others")
| eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
| eval percentage_variance=abs(round(((Yesterday-Today)/Yesterday)*100,2))
| table Name Consumer Today Yesterday percentage_variance

Expected Result:

NameConsumerTodayYesterdaypercentage_variance
TENUP10100.0%
Labels (4)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming these are counts, you need to get values for Today and Yesterday into the same event in the pipeline. Try something like this

basesearch earliest=@d latest=now
| append
[ search earliest=-1d@d latest=-1d]
| eval Consumer = case(match(File_Name,"^ABC"), "Down", match(File_Name,"^csd"),"UP", match(File_Name,"^CSD"),"UP",1==1,"Others")
| eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
| stats count by Name Consumer Day
| eval {Day}=count
| fields - Day
| stats values(Today) as Today values(Yesterday) as Yesterday by Name Consumer
| eval percentage_variance=abs(round(((Yesterday-Today)/Yesterday)*100,2))
| table Name Consumer Today Yesterday percentage_variance

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming these are counts, you need to get values for Today and Yesterday into the same event in the pipeline. Try something like this

basesearch earliest=@d latest=now
| append
[ search earliest=-1d@d latest=-1d]
| eval Consumer = case(match(File_Name,"^ABC"), "Down", match(File_Name,"^csd"),"UP", match(File_Name,"^CSD"),"UP",1==1,"Others")
| eval Day=if(_time<relative_time(now(),"@d"),"Yesterday","Today")
| stats count by Name Consumer Day
| eval {Day}=count
| fields - Day
| stats values(Today) as Today values(Yesterday) as Yesterday by Name Consumer
| eval percentage_variance=abs(round(((Yesterday-Today)/Yesterday)*100,2))
| table Name Consumer Today Yesterday percentage_variance
0 Karma

selvam_sekar
Path Finder

Many Thanks @ITWhisperer . In this SPL Logic how do we ignore the weekend dataand bring only the last working day count for yesterday ? is it possible ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Change this line so that it takes into account what the previous day is

[ search earliest=-1d@d latest=-1d]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...