I have spl in splunk
index=demo
search compliance= standard1 | timechart span=1week count by status
| add totals row=t enable not_enable fieldname= "total"
| eval percentage = round((enable / total ) * 100 , 0) . " %"
| reverse
| table _time percentage
above spl show percentage week over week I want to show anther column show percentage different between last week and week before how do I show this next to last week row?
If week before is 56% percentage and last week percentage 70% it need show next last week row 14%
how can I do this? I try join append it did not work for me.
Thanks in advance
You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂
The two commands which let you "carry over" data from one row to another are autoregress and streamstats.
autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...
You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂
The two commands which let you "carry over" data from one row to another are autoregress and streamstats.
autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...