topic Re: Delta on serveral fields, separate by id in Splunk Search

Delta on serveral fields, separate by id

sbsbb — Wed, 19 Jun 2013 16:49:05 GMT

I have multiple events like :

field 1; otherTimestamp; field2;field3;field4
test;1371481920.000000,value2,valeu3...
test,1371481980.000000,value4,value5...
otherttest,1371481920.000000,value...

I want to compute a delta on the othertimestamp field, but the delta should be 0, if the field1 changed... I also want to see all other fields for each event.

I tried to use delta, but I couldn't make delta begin at 0, on field1 changed...

I've tried to put a | transaction field1 | in front of the delta, but then all the lines are in a single event, and I'd like distinct events...

Can I do it with streamstats somehow ? what is the best way

Re: Delta on serveral fields, separate by id

Ayn — Wed, 19 Jun 2013 17:02:50 GMT

Did you see this? http://splunk-base.splunk.com/answers/47037/delta-then-sum-then-graph-from-multiple-hosts

It shows how to create a delta split by certain fields using streamstats.

Re: Delta on serveral fields, separate by id

sbsbb — Wed, 19 Jun 2013 17:32:34 GMT

Yes but in all examples, it is always grouping things...
I want only to compute the delta when event have the same ID_fields, but I need to see all the events...

Re: Delta on serveral fields, separate by id

Ayn — Wed, 19 Jun 2013 17:56:27 GMT

well "same ID_fields" <-- that's grouping, no? streamstats ... by yourfield

Re: Delta on serveral fields, separate by id

sbsbb — Wed, 19 Jun 2013 18:14:36 GMT

ok, but there are other fields that are different on each event... see example value2, value4, if I make a group by the id_field, I'm also loosing all other fields ?

Re: Delta on serveral fields, separate by id

Ayn — Wed, 19 Jun 2013 18:17:30 GMT

No. streamstats does not remove any fields, it just writes a couple more to each event.

Re: Delta on serveral fields, separate by id

sbsbb — Mon, 24 Jun 2013 22:41:47 GMT

Could you post me an example, on how to do it, according to this example ?
( making a delta on one field, and only displaying the others)

Re: Delta on serveral fields, separate by id

Ayn — Tue, 25 Jun 2013 06:13:10 GMT

Something like this:

... | streamstats window=2 current=t global=f earliest(otherTimestamp) as curr, latest(otherTimestamp) as next by field1 | eval delta=next-curr

Re: Delta on serveral fields, separate by id

sbsbb — Tue, 25 Jun 2013 13:45:32 GMT

Thank you, but how can I display all the fields from current ?

Re: Delta on serveral fields, separate by id

Ayn — Tue, 25 Jun 2013 14:24:01 GMT

See streamstats docs. Remove window. I'm expecting you to do some work yourself here - I'm just giving you pointers on how to solve your problem.

Re: Delta on serveral fields, separate by id

maraman_splunk — Tue, 11 Apr 2017 09:26:37 GMT

correct url : https://answers.splunk.com/answers/47037/delta-then-sum-then-graph-from-multiple-hosts.html