Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I compare distinct counts of a given field between two different time ranges within the same Splunk search?

$
0
0
I have a CSV file that a list of customers and their orders. The format is as follows: OrderDate, OrderNumber, Customer, OrderAmount Same order number can be on multiple lines because a customer can order multiple items under the same order number. Now, what I want to do is compare the order volume by customer between two years. Example output: Customer, 2014 Orders, 2015 Orders, Difference CustA, 100, 60, -40 CustB, 70, 80, 10 ... I am trying to identify which customers have had a significant decrease in orders and which ones have had a significant increase year over year. I've tried the following but it gives me no search results: sourcetype="SALESCSV" [search earliest="1/1/2014:00:00:00" latest="12/31/2014:23:59:59" Geography=EMEA search_name="2014 Orders"] [search earliest="1/1/2015:00:00:00" latest="12/31/2015:23:59:59" Geography=EMEA search_name="2015 Orders"] | stats dc(OrderNumber) by search_name

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>