Dashboards & Visualizations

New to Splunk

Menorel
Loves-to-Learn

Hello All,

Been trying to get the hang of syntax within Splunk and have been able to sus out a basic understanding, true to form for myself, I usually end up jumping into the deep end when I do things, so bear with me.

I am attempting to creat a report/search/dashboard that looks over the last four hours and will display the largest percent increase of a value.

The field is BIN currently stored as a numerical value, I have tried the tostring command to transform it but usually ends up as no values being returned or them all being grouped together.

But I digress, how would I first create a search/table view that would be updated along a described timeframe lets say every hour where it looks at the previous timeframe as a percentage of total records for that timeframe and calculates the percentage increase of the two timeframes and filters to see the top 20 increases?

Example:

I would want to ignore any decreasing values and possibly only see the top 20 that had increased that are greater than or equal to a 15% increase.

 

BINPercent 2 hour agoPercent 1 hr agoPecent change
12345610%12%16.7%
23456110%8%-25%
34561230%25%-20%
45612335%30%-16.7%
56123415%

25%

40%

 

 

Labels (1)
Tags (2)
0 Karma