topic Re: Calculation in Dashboard in Dashboards & Visualizations

Calculation in Dashboard

naomibn — Tue, 24 Apr 2018 01:18:01 GMT

Hello everyone,

I am completely new to splunk,. I have a Dashboard requirement where I need to display the difference of the first column of numbers every 15 minutes. The log is updating every 10-15 minutes in real time. For ex: first record in the graph should be 99( 1100-1001)

2018-04-21 00:00:00 INFO Switching to next trail file due to EOF
1001 abc done on 2018-04-21 00:45:38
1100 agc done on 2018-04-21 00:55:30
1200 ybc done on 2018-04-21 01:05:39
...................................
.....................................
2400 bcd done on 2018-04-21 10:40:38

Please assist in how I can achieve this.

Thanks,
Naomi

Re: Calculation in Dashboard

ssadanala1 — Tue, 24 Apr 2018 03:54:58 GMT

Hope this search satisfies your requirement

|makeresults | eval event = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" |eval event = split(event, ",")|mvexpand event| rex field=event "(?\d+)\s+(?P\w+)\s+(?P\w+)" |delta first as firstcolumndiff

Re: Calculation in Dashboard

woodcock — Tue, 24 Apr 2018 23:04:54 GMT

Try this:

| makeresults 
| eval raw = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" 
| eval raw = split(raw, ",") 
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "(?<value>\d+)\s+(?<which>\S+)\s+\S+\s+on\s+(?<_time>[^,]+)"
| eval _time = strptime(_time, "%Y-%m-%d %H:%M:%S")
| sort 0 - _time
| reverse
| delta value
| reverse

Re: Calculation in Dashboard

naomibn — Fri, 27 Jul 2018 06:44:14 GMT

I got it working. Thanks