I am new to Splunk and need guidance on writing a generic search that will give me the percent increase over a two month period. For example, let's say my event data has the following fields: page="foo.html", success_rate=99.0, _time=2014-12-01 page="foo.html", success_rate=99.5, _time=2014-11-01 page="bar.html", success_rate=100, _time=2014-12-01 page="bar.html", success_rate=100, _time=2014-11-01 I would like my results to be: Page Name | Success Rate Change foo.html | -0.5 bar.html | 0 Here is another example: Events page="foo.html", response_time=40, _time=2014-11-1 page="foo.html", response_time=50, _time=2014-12-1 page="bar.html", response_time=3, _time=2014-11-1 page="bar.html", response_time=1, _time=2014-12-1 Desired Results Page | Response Time Percent Increase foo.html | 25 bar.html | -66.66 This shows foo.html's response time grew 25% and bar.html's reduced 66% from Nov to Dec. I've gotten this to work with the follow query: | eval month=strftime(_time,"%b") | chart avg(success_rate) by page, month | convert num("Dec") as dec_res num("Nov") as nov_res | eval rs_diff = (((dec_res / nov_res) * 100) - 100) | table page rs_diff However, this is not very flexible as I have to get the column by the month's name. This will only work for a month and then I have to change it. How can I get the same results without using hard-coded values? ... View more