Splunk Search

finding percentage different between last week and week before?

abi2023
Path Finder

I have spl in splunk
index=demo 
search compliance= standard1 | timechart span=1week count by status 
| add totals row=t enable not_enable fieldname= "total"
| eval percentage = round((enable / total ) * 100 , 0) . " %"
| reverse 
| table _time percentage 

above spl show percentage week over week I want to show anther column show percentage different between last week and week before how do I show this next to last week row?
If week before is 56% percentage and last week percentage 70% it need show next last week row 14% 
how can I do this? I try join append it did not work for me.
Thanks in advance

Labels (3)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...