Hi all, First post here - So I'm a Splunk beginner & recently got this tricky task. So let's say I have these rows in my log file: 2020-01-01: error778 2020-01-02: error778 2020-01-03: error778 2020-01-16: error778 2020-02-01: error778 2020-02-04: error778 2020-02-06: error778 2020-02-10: error778 2020-02-18: error778 2020-02-19: error778 On Jan 2020, we can see that there are 4 rows of error778 On Feb 2020, we can see that there are 6 rows of error778 This means, from Jan 2020 to Feb 2020, there's 50% diff/increase of error778. The questions: How can I get/display the % difference? Ideally, the delimiters can be days, month, year, or date ranges (such as, diff of error778 between 1-5 Jan 2020 and 5-31 Jan 2020). What's the best way to set an alert based on % (say, alert when diff is > 15%)? I'm able to display the daily/weekly/monthly trend of a keyword using timechart like below index=mylog "error778" | timechart span=1month count by date But I believe it's far from what I need. Any help would be appreciated, thanks.
... View more
