Splunk Search

finding percentage different between last week and week before?

abi2023
Path Finder

I have spl in splunk
index=demo 
search compliance= standard1 | timechart span=1week count by status 
| add totals row=t enable not_enable fieldname= "total"
| eval percentage = round((enable / total ) * 100 , 0) . " %"
| reverse 
| table _time percentage 

above spl show percentage week over week I want to show anther column show percentage different between last week and week before how do I show this next to last week row?
If week before is 56% percentage and last week percentage 70% it need show next last week row 14% 
how can I do this? I try join append it did not work for me.
Thanks in advance

Labels (3)
Tags (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

You probably could do that using join while bending over backwards to generate an artificial temporary join field but this makes no sense 🙂

The two commands which let you "carry over" data from one row to another are autoregress and streamstats.

autoregress is pretty straightforward, streamstats is a bit less obvious since it's a statistical command but it can also be used in such way - see my thread here https://community.splunk.com/t5/Splunk-Search/Streamstats-vs-autoregress/m-p/575104/highlight/true#M...

 

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...