https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48597#M11591 <P>Hi,</P> <P>I want to write a query to compare performance counter's values over 20 min span where the counter values change more than 1000.</P> <P>Your help is appreciated! </P> Tue, 27 Aug 2013 20:08:22 GMT jcl_tw0 2013-08-27T20:08:22Z https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48597#M11591 <P>Hi,</P> <P>I want to write a query to compare performance counter's values over 20 min span where the counter values change more than 1000.</P> <P>Your help is appreciated! </P> Tue, 27 Aug 2013 20:08:22 GMT https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48597#M11591 jcl_tw0 2013-08-27T20:08:22Z https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48598#M11592 <P>Can you provide some sample events or context?</P> Tue, 10 Sep 2013 11:24:31 GMT https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48598#M11592 rturk 2013-09-10T11:24:31Z https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48599#M11593 <P>For example<BR /> - 9/10/13 3:00 PM - counter 1, counter value 13240 <BR /> - 9/10/13 3:00 PM - counter 2, counter value 12700 <BR /> - 9/10/13 3:10 PM - counter 1, counter value 13340<BR /> - 9/10/13 3:10 PM - counter 2, counter value 13800 <BR /> - 9/10/13 3:20 PM - counter 1, counter value 13430 <BR /> - 9/10/13 3:20 PM - counter 2, counter value 14850<BR /> - 9/10/13 3:30 PM - counter 1, counter value 15200 <BR /> - 9/10/13 3:30 PM - counter 2, counter value 16200 </P> <P>In the span of 20 minutes between 3:00 PM to 3:30 PM which counter has counter value changes less than 1000. Answer is counter 1 bet 3:00 PM to 3:20 PM, value 190</P> Wed, 11 Sep 2013 01:05:14 GMT https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48599#M11593 jcl_tw0 2013-09-11T01:05:14Z https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48600#M11594 <P>I think you can try below command :<BR /> sourcetype=counter | bucket _time span=20m | stats min(counter_value) as min_cv max(counter_value) as max_cv by counter, _time | eval diff = max_cv- min_cv | search diff&lt;1000</P> <P>by the way, if your time span is 20 minutes , the answer should be counter 1 between 3:00:00pm to 3:19:59pm ( not 3:20:00pm) value=100 , 3:20:00 is the beginning of next 20 minutes , right ?</P> Mon, 28 Sep 2020 14:44:56 GMT https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48600#M11594 dmlee 2020-09-28T14:44:56Z https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48601#M11595 <P>I have combine data from 20 minutes before the most recent data.<BR /> But is long ...</P> <P>sourcetype=counter|eval key=_time.counter|rename value as base_value|table key,_time,counter,base_value|join key[search sourcetype=counter|eval key=round(relative_time(_time,"-20m@m")).counter|rename _time as ago_time,value as ago_value|table key,ago_time,counter,ago_value]|eval period=strftime(_time,"%Y/%m/%d %H:%M-").strftime(ago_time,"%H:%M")|eval difference=abs(base_value-ago_value)|table period,counter,difference|where difference&lt;1000</P> <P>(result)<BR /> <IMG src="http://splunk-base.splunk.com//storage/sample_10.png" alt="alt text" /></P> Mon, 28 Sep 2020 14:44:58 GMT https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48601#M11595 HiroshiSatoh 2020-09-28T14:44:58Z https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48602#M11596 <P>I ran the query but the CounterValue, min_cv and max_cv values are the same so the diff between min_cv and max_cv is 0</P> Mon, 28 Sep 2020 14:47:20 GMT https://community.splunk.com/t5/Splunk-Search/Compare-two-counter-values-in-time/m-p/48602#M11596 jcl_tw0 2020-09-28T14:47:20Z