Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to create a single value trend to show the difference based on the previous day?

$
0
0
Hi , I need to create a single value visualization with the trend indicator. The trend indicator should be the difference based on the previous day difference. Below is the search and the response from the search But when it calculates the trend, it's taking percentage change ie, `(80-20)/20 *100% = 300%` instead of simply giving the difference as it is already in % (80%-20%)= +60% . Please advise if I'm missing out something here. day FILLCNT tempcount FILRATE totalcount 20 1 1746 80 2193 19 1 447 20 2193 sourcetype=mysourcetype | eval day = strftime(strptime(Timestamp,"%Y-%m-%d-%H.%M.%S.%6N"),"%d") | eval FILLCNT =if((myfillfield = "Y"),1,0)| stats count as tempcount by day,FILLCNT| eventstats sum(tempcount) as totalcount by cur |eval FILRATE = round((tempcount /totalcount) * 100,0) |sort -FILLCNT -day -2dnow 60

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>