Filter using delta command

bmer — Sun, 21 Jul 2024 10:50:05 GMT

Iam using 👇 splunk with delta command

index=xxxx source=xxxx rcrdType=xxx | timechart span=1h avg(requestSize) avg(responseSize)|delta avg(requestSize) |delta avg(responseSize)

I need to modify the query to ONLY include those events where either delta avg(requestSize) OR delta avg(responseSize) OR both are positive

Re: Filter using delta command

ITWhisperer — Sun, 21 Jul 2024 10:53:42 GMT

Try something like this

| where 'delta(avg(requestSize))' > 0 OR 'delta(avg(responseSize))' > 0