Splunk Search

How to create a report on storage growth with percentages?

SimonTurton
New Member

I have managed to pull together the following

| mstats max(_value) prestats=true WHERE metric_name="df.used" span=1mon AND host IN (server1.fqdn,server2.fqdn,server3.fqdn, server4.fqdn)
| timechart max(_value) as "max" span=1mon by host

I am struggling to work out how to add a column which shows percentage differences on the previous max value

ideally, I want to produce something like the below

any pointers greatly appreciated!???

  Totals percentage change   percentage change   percentage change   percentage change
  Server1   Server2   Server3   Server4  
2021-12 66.0454   62.2212   58.0469   60.6775  
2022-01 68.8615 4.26% 63.6594 2.31% 58.0931 0.08% 60.6775 0.00%
2022-02 68.0096 -1.24% 57.1727 -10.19% 58.3543 0.45% 60.6775 0.00%
2022-03 69.0297 1.50% 57.5982 0.74% 58.3765 0.04% 60.6775 0.00%
2022-04 74.4503 7.85% 56.7901 -1.40% 58.3883 0.02% 60.6775 0.00%
2022-05 79.0023 6.11% 54.415 -4.18% 58.2995 -0.15% 60.6775 0.00%
2022-06 84.5459 7.02% 54.5954 0.33% 58.3365 0.06% 60.6775 0.00%
Average growth   4.25%   -2.06%   0.08%   0.00%
Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@SimonTurton - You can use streamstats command for that.

Your query here
| streamstats current=f window=1 values(Server*) as Prev_Server*
| foreach "Server*" [| eval "Change <<FIELD>>"=round((<<FIELD>>-Prev_<<FIELD>>)*100/Prev_<<FIELD>>,2)]

 

Here is my sample query that I used to test:

| makeresults | eval Server1=66.0454, Server2=62.2212
| append [| makeresults | eval Server1=68.8615, Server2=63.6594]
| append [| makeresults | eval Server1=68.0096, Server2=57.1727]
| streamstats current=f window=1 values(Server*) as Prev_Server*
| foreach "Server*" [| eval "Change <<FIELD>>"=round((<<FIELD>>-Prev_<<FIELD>>)*100/Prev_<<FIELD>>,2)]

VatsalJagani_0-1656582011153.png

 

I hope this helps!!! Upvote/karma would be appreciated!!!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...