I have managed to pull together the following
| mstats max(_value) prestats=true WHERE metric_name="df.used" span=1mon AND host IN (server1.fqdn,server2.fqdn,server3.fqdn, server4.fqdn)
| timechart max(_value) as "max" span=1mon by host
I am struggling to work out how to add a column which shows percentage differences on the previous max value
ideally, I want to produce something like the below
any pointers greatly appreciated!???
Totals | percentage change | percentage change | percentage change | percentage change | ||||
Server1 | Server2 | Server3 | Server4 | |||||
2021-12 | 66.0454 | 62.2212 | 58.0469 | 60.6775 | ||||
2022-01 | 68.8615 | 4.26% | 63.6594 | 2.31% | 58.0931 | 0.08% | 60.6775 | 0.00% |
2022-02 | 68.0096 | -1.24% | 57.1727 | -10.19% | 58.3543 | 0.45% | 60.6775 | 0.00% |
2022-03 | 69.0297 | 1.50% | 57.5982 | 0.74% | 58.3765 | 0.04% | 60.6775 | 0.00% |
2022-04 | 74.4503 | 7.85% | 56.7901 | -1.40% | 58.3883 | 0.02% | 60.6775 | 0.00% |
2022-05 | 79.0023 | 6.11% | 54.415 | -4.18% | 58.2995 | -0.15% | 60.6775 | 0.00% |
2022-06 | 84.5459 | 7.02% | 54.5954 | 0.33% | 58.3365 | 0.06% | 60.6775 | 0.00% |
Average growth | 4.25% | -2.06% | 0.08% | 0.00% |
@SimonTurton - You can use streamstats command for that.
Your query here
| streamstats current=f window=1 values(Server*) as Prev_Server*
| foreach "Server*" [| eval "Change <<FIELD>>"=round((<<FIELD>>-Prev_<<FIELD>>)*100/Prev_<<FIELD>>,2)]
Here is my sample query that I used to test:
| makeresults | eval Server1=66.0454, Server2=62.2212
| append [| makeresults | eval Server1=68.8615, Server2=63.6594]
| append [| makeresults | eval Server1=68.0096, Server2=57.1727]
| streamstats current=f window=1 values(Server*) as Prev_Server*
| foreach "Server*" [| eval "Change <<FIELD>>"=round((<<FIELD>>-Prev_<<FIELD>>)*100/Prev_<<FIELD>>,2)]
I hope this helps!!! Upvote/karma would be appreciated!!!