Difference between two perfmon counters from the same source to identify bottleneck

rholm01 — Fri, 26 Feb 2021 20:39:23 GMT

Counter 1 - Perfmon: Inbound Data rate

Counter 2 - Perfmon:Outbound Data rate

source="Perfmon:PostilionPostbridgeInterchanges"

My values look something like this: 0.007956853689073186

I am looking for the difference between the two counters and to reduce the number to 3 places behind the decimal point, if possible.

Re: Difference between two perfmon counters from the same source to identify bottleneck

tscroggins — Sat, 27 Feb 2021 19:47:17 GMT

@rholm01

This may work:

| streamstats current=f last(Value) as previous_Value by host counter
| eval delta_Value=round(Value - previous_Value, 3)

If you want the absolute difference:

| eval delta_Value=round(abs(Value - previous_Value), 3)

If you find Splunk's rounded values disagreeing with exact calculations, you can tell Splunk to use exact math to the limits of the operating environment's floating point precision:

| eval delta_Value=exact(round(abs(Value - previous_Value), 3))

topic Re: Difference between two perfmon counters from the same source to identify bottleneck in Splunk Search

Difference between two perfmon counters from the same source to identify bottleneck

Re: Difference between two perfmon counters from the same source to identify bottleneck