baseline,The previous value minus the next value?

Path Finder

I want to make a baseline,statistical the success rate.The current time success rate minus the last time success rate, then, divided by the time 60m,all the success rate of such,alt textwhat should I do?


Tags (2)
0 Karma

Revered Legend

Try something like this

Your base search giving fields 'Time' and 'rate' | sort Time | streamstats current=f window=1 first(rate) as prevRate | sort -Time | eval baselineRate=round((rate-prevRate)/60,2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!