Hi,
I am new two splunk. I am wondering is there a way to calculate the delta of RXdropped from 5 minutes apart.
10:50:00 RXdropped
123
10:55:00 RXdropped
456
I did this it seems to work for now.
index=os sourcetype="interfaces" host="prdcg4mdbl03.oss.prd" | multikv | eval PercError_PacketLoss=round(((Error * 100)/(RXbytes+TXbytes)),1) | eval StatusError = if(PercError_PacketLoss >= 1.0, "WARNING", "OK") | eval PercRX_PacketLoss=round(((RXdropped * 100)/RXbytes),1) | eval PercTX_PacketLoss=round(((TXdropped * 100)/TXbytes),1) | eval StatusRX = if(PercRX_PacketLoss >= 1.0, "WARNING", "OK") | eval StatusTX = if(PercTX_PacketLoss >= 1.0, "WARNING", "OK") | table time Name StatusError PercError_PacketLoss StatusRX PercRX_PacketLoss StatusTX PercTX_PacketLoss
Hello! Welcome to Splunk!
If you download the *NIX App, you'll find there is a dashboard for network traffic.
Here's the link: http://splunk-base.splunk.com/apps/22314/splunk-for-unix-and-linux
This is the search that the *nix app uses:
index="os" sourcetype="interfaces" host=* | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput = lastRX-RXbytes | eval TX_Thruput = lastTX-TXbytes | timechart eval(sum(TX_Thruput)/dc(time)) by Interface_Host
In the "streamstats" function, it's creating two new fields: last(Txbytes) as lastTX, and last(Rxbytes) as lastRX. Later it subtracts the last value from the current value with:
Eval RX_Thruput=lastRX-Rxbytes
The last() function gets the most recent value of a field and adds it to the current event. Remember that the default order of events in Splunk is reverse chronological order, so when an event gets the "last" value of a field it's getting it from a later time, so subtracting the "current" value from the "last" value give us the difference, which is the throughput for the period.
Best regards,
Jon
It is calculating the delta.
This eval statement subtracts Rxbytes from lastRX and assigns the result to RX_Thruput.
eval RX_Thruput=lastRX-Rxbytes
In other words:
lastRX (456) - Rxbytes (123) = RX_Thruput (333)
It's not using RXdropped, but if you use RXdropped you'll get the results you want.
For some reasons, I could not get the right result using your query.
Hi Jon,
Thanks for your fast response. I really appreciated that. The result is not what I expected. I am looking for the delta. Something like this.
456 - 123 = 333