Hi. im new to Splunk.
I'm trying to compare the sum(bytes) for an hour ago, and the same hour one week before by certain field, and calculate the percentage change for these data. I have tried the following code, but the sum(bytes) it gives for doesn't match the actual value.
index=xxx earliest=-60m latest=now | stats sum(bytes) as current by abc | appendcols [search index=xxx earliest=-1h@h-1w latest=@h-1w | stats sum(bytes) as before by abc] | eval diff=current-before | eval percentagediff=round(abs(diff/before)*100,0)
The problem is that the current and the before values it returns are really off the actual value it should be at that time.
May you guys please give me some ideas or suggestions of where could this go wrong?
Thank you
↧