After a bit of working through this and understanding it, this works perfectly, TY The below is closer to the actual data I was using. | makeresults format=csv data="bus_date, appl, tran_coun...
See more...
After a bit of working through this and understanding it, this works perfectly, TY The below is closer to the actual data I was using. | makeresults format=csv data="bus_date, appl, tran_count 20250122,appl1,336474 20250122,appl2,93 20250122,appl3,6 20250122,appl4,10585 20250123,appl1,2061 20250123,appl2,1075 20250123,appl3,1 20250123,appl4,190 20250124,appl1,6 20250124,appl2,40635 20250124,appl3,786 20250124,appl4,12978 20250125,appl1,140 20250125,appl2,133 20250125,appl3,514 20250125,appl4,125449 20250126,appl1,98 20250126,appl2,5 20250126,appl3,5258 20250126,appl4,3424 20250127,appl1,596 20250127,appl2,1 20250127,appl3,265 20250127,appl4,3 20250128,appl1,38200 20250128,appl2,1320 20250128,appl3,11706 20250128,appl4,114" | fields bus_date, appl, tran_count | streamstats c by appl | sort bus_date | stats latest(bus_date) as bus_date avg(eval(if(c=1, null(), tran_count))) as Avg6day latest(tran_count) as todays_total by appl | eval Variance=todays_total-Avg6day | sort appl - bus_date | table bus_date appl, todays_total, Avg6day, Variance