https://community.splunk.com/t5/Splunk-Search/How-to-display-rate-from-field-value/m-p/36925#M8217 <P>Very new to this pipeline way of thinking, so apologies if this is trivial...</P> <P>I am logging every <STRONG>10</STRONG> seconds the total number of <STRONG>X</STRONG> which have been cached. So this is incremental: <STRONG>1, 2, 5, 8, 9, 15</STRONG> etc. So each log message contains the following <STRONG>TotalCached=x</STRONG> where <STRONG>x</STRONG> is the number cached.</P> <P>Now I want to chart the <STRONG>rate</STRONG> at which they are being cached. For the range of numbers above, I would like to see the values <STRONG>0, 1, 3, 3, 1, 6</STRONG> on a <STRONG>timechart</STRONG>.</P> <P>I have been told to look at <STRONG>delta</STRONG> and <STRONG>streamstats</STRONG> to no avail.</P> <P><STRONG>EDIT</STRONG></P> <P>This is close to what I want:<BR /><BR /> <CODE>source="..." FeedSource="PinnacleApi" SportId="Football" | delta TotalFixtures p=1 as fixDelta | timechart sum(fixDelta)</CODE></P> <P>However I'd like to take off the FeedSource and SportId, and have the timechart display results by FeedSource or SportId. When I do do this it makes some strange results! </P> Thu, 26 Apr 2012 10:27:52 GMT matthewcanty 2012-04-26T10:27:52Z https://community.splunk.com/t5/Splunk-Search/How-to-display-rate-from-field-value/m-p/36925#M8217 <P>Very new to this pipeline way of thinking, so apologies if this is trivial...</P> <P>I am logging every <STRONG>10</STRONG> seconds the total number of <STRONG>X</STRONG> which have been cached. So this is incremental: <STRONG>1, 2, 5, 8, 9, 15</STRONG> etc. So each log message contains the following <STRONG>TotalCached=x</STRONG> where <STRONG>x</STRONG> is the number cached.</P> <P>Now I want to chart the <STRONG>rate</STRONG> at which they are being cached. For the range of numbers above, I would like to see the values <STRONG>0, 1, 3, 3, 1, 6</STRONG> on a <STRONG>timechart</STRONG>.</P> <P>I have been told to look at <STRONG>delta</STRONG> and <STRONG>streamstats</STRONG> to no avail.</P> <P><STRONG>EDIT</STRONG></P> <P>This is close to what I want:<BR /><BR /> <CODE>source="..." FeedSource="PinnacleApi" SportId="Football" | delta TotalFixtures p=1 as fixDelta | timechart sum(fixDelta)</CODE></P> <P>However I'd like to take off the FeedSource and SportId, and have the timechart display results by FeedSource or SportId. When I do do this it makes some strange results! </P> Thu, 26 Apr 2012 10:27:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-rate-from-field-value/m-p/36925#M8217 matthewcanty 2012-04-26T10:27:52Z https://community.splunk.com/t5/Splunk-Search/How-to-display-rate-from-field-value/m-p/36926#M8218 <P>Changed the way we are logging. Logged the rate instead of the total, then did per_second(X)</P> Wed, 23 May 2012 08:35:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-rate-from-field-value/m-p/36926#M8218 matthewcanty 2012-05-23T08:35:32Z