https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35893#M7922 <P>Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?</P> Thu, 26 Apr 2012 09:27:32 GMT matthewcanty 2012-04-26T09:27:32Z https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35891#M7920 <P>I want to take a totals field. And display the rate on a chart.</P> <P><STRONG>For example:</STRONG></P> <P>Total = 0, 1, 2, 3, 4, 5, 6, 7, 9, 10</P> <P>Rate = 0, 1, 1, 1, 1, 1, 1, 1, 2, 1.</P> <PRE><CODE> __ _____________________/ \__ ____/ </CODE></PRE> <P>Take that as a rough guide anyway. I have looked through List(X) to see all my values which works, but I cannot figure out how you subtract the Last(X) value from the 'LastMinusOne(X)' value...</P> <P>Thanks - and sorry for the crude graph <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 25 Apr 2012 16:12:40 GMT https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35891#M7920 matthewcanty 2012-04-25T16:12:40Z https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35892#M7921 <P>I think the <CODE>delta</CODE> command is what you're looking for:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta</A></P> <PRE><CODE> ... | delta total as rate | eval rate=coalesce(rate,0) </CODE></PRE> Wed, 25 Apr 2012 17:31:29 GMT https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35892#M7921 ziegfried 2012-04-25T17:31:29Z https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35893#M7922 <P>Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?</P> Thu, 26 Apr 2012 09:27:32 GMT https://community.splunk.com/t5/Splunk-Search/Find-rate-from-total/m-p/35893#M7922 matthewcanty 2012-04-26T09:27:32Z