Streamstats delta between values on grouped data incorrect

peiffer — Sat, 03 Mar 2018 14:07:10 GMT

I have data that is extracted from log events by multiple neighbor pairs. I would like to extract deltas on an integer field tableversion, but only among the same neighbor pair Streamstats was suggested for deltas with a ‘by’ clause. In my example below, the first line delta is empty as expected, and the 2nd line delta is correct. All deltas in later lines are incorrect. How do I make streamstats only look at the previous entry?

index=network_internal source="bgp.log" "BGP Queue" 
| eval neighborpair=host + ":" + neighbor
| sort neighborpair,timestamp
| streamstats window=2 global=f current=f first(tableversion) as tableversion_prev by neighborpair
| eval delta=tableversion-tableversion_prev
| table timestamp neighborpair neighborstate nsrstate tableversion delta inq outq prefixes

Re: Streamstats delta between values on grouped data incorrect

martin_mueller — Sat, 03 Mar 2018 18:29:17 GMT

Either set current=t or window=1.

Re: Streamstats delta between values on grouped data incorrect

peiffer — Sat, 03 Mar 2018 23:35:16 GMT

Setting window=1 didn't work for me, but current=t did.

Thanks much

topic Re: Streamstats delta between values on grouped data incorrect in Splunk Search

Streamstats delta between values on grouped data incorrect

Re: Streamstats delta between values on grouped data incorrect

Re: Streamstats delta between values on grouped data incorrect