topic Re: How to find the timechart of difference value . in Splunk Search

How to find the timechart of difference value .

Padma12345 — Fri, 01 Jul 2016 03:39:05 GMT

I have one field abc which contain values of different parameter and it goes on increasing gradually. I have to add the values present in the field abc at two different intervals and then the difference of that two values. I want the timechart of that difference value.
Following is the example

At 12.00 AM                           At 12.00 PM
def         abc                       def         abc
xxx         11                        xxx         13
xxy         23                        xxy         25
xyy         09                        xyy         11
yyy         45                        yyy         48

What I have to do is add values of field abc which contain x at 12 am & 12 pm and then want to show timechart of the difference. i.e at 12 am: 11+23+09=43 & at 12 pm: 13+25+11=49, then 49-43= 7, then timechart this value.

Any help is appreciated..

Thanks.....!

Padma

Re: How to find the timechart of difference value .

woodcock — Fri, 01 Jul 2016 15:53:17 GMT

Show me 2 raw events and I will give you an answer. I do not understand the raw event format.

Re: How to find the timechart of difference value .

Richfez — Sat, 02 Jul 2016 02:07:47 GMT

I started thinking streamstats, then foreach, but finally settled on exactly what woodcock said - a few raw events would go very far in helping us understand the question better and without them we're more or less blind.

Re: How to find the timechart of difference value .

Padma12345 — Mon, 04 Jul 2016 06:45:06 GMT

Please find the below raw events

7/4/16
11:30:00.000 AM
"1467612000.000","-","xxx","37211.2265625"
7/4/16
11:30:00.000 AM
"1467612000.000","-","xxy","45632.70703125"

7/4/16
11:15:00.000 AM
"1467611100.000","-","xxx","37208.40234375"
7/4/16
11:15:00.000 AM
"1467611100.000","-","xxy","45629.41015625"

I want to add value of xxx & xxy at 11.15 & 11.30 am and then need to plot the timechart of difference value.

Thanks

Padma

Re: How to find the timechart of difference value .

sundareshr — Mon, 04 Jul 2016 14:46:59 GMT

Try this

index=* def="*x*" abc=* | timechart span=15m sum(abc) as total | delta total as delta | fields - total

Re: How to find the timechart of difference value .

woodcock — Mon, 04 Jul 2016 15:04:46 GMT

I am taking a VERY loose interpretation of the timechart portion of your request (otherwise it doesn't make sense). Like this:

... stats min(_time) AS startTime max(_time) AS endTime sum(xxx) AS xxx sum(xxy) AS xxy | eval diff=abs(xxx-xxy)