Hello Splunk Ninjas I'm trying to convert my addcoltotals of MB to TB using the eval statement which does not work.... index=myindex sourcetype=mysourcetype | table Cluster, Capacity_MB | addcoltotals label=TOTALS labelfield=Cluster | eval TOTALS = round(TOTALS/1024,2) Thanks! ... View more

I'm trying to build a search to show the difference of the field total across a 120 day interval. The search I have below works, but its taking the min and max number across the whole 120 day interval, finding the difference, then computing a %. I need the search to take the first value on day 1, the last value on day 120, and show the difference and compute the percentage... For the time interval, I was just using the time picker.... Search: | stats max(total) as Max, min(total) as Min, range(total) as Difference | eval Difference_Percent = Difference / Max * 100 | rename Difference_Percent as "Growth %" ... View more