Dashboards & Visualizations

New to Splunk

Menorel
Loves-to-Learn

Hello All,

Been trying to get the hang of syntax within Splunk and have been able to sus out a basic understanding, true to form for myself, I usually end up jumping into the deep end when I do things, so bear with me.

I am attempting to creat a report/search/dashboard that looks over the last four hours and will display the largest percent increase of a value.

The field is BIN currently stored as a numerical value, I have tried the tostring command to transform it but usually ends up as no values being returned or them all being grouped together.

But I digress, how would I first create a search/table view that would be updated along a described timeframe lets say every hour where it looks at the previous timeframe as a percentage of total records for that timeframe and calculates the percentage increase of the two timeframes and filters to see the top 20 increases?

Example:

I would want to ignore any decreasing values and possibly only see the top 20 that had increased that are greater than or equal to a 15% increase.

 

BINPercent 2 hour agoPercent 1 hr agoPecent change
12345610%12%16.7%
23456110%8%-25%
34561230%25%-20%
45612335%30%-16.7%
56123415%

25%

40%

 

 

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...