Archive
Highlighted

grouping by host

Explorer

I have to calculate the change of a field(xyz) over the past 6 hours on a per host basis. I have calculated the same for a single host specified in the query itself. The code is as follows:

index=ck sourcetype=a_log host = hkv earliest=-6h | delta du as useddiff |
fillnull value=0.00 useddiff | eval velo=useddiff/15 | table time du useddiff velo

I now need to do the same for multiple hosts separately and display a timechart of all of the hosts together. Kindly tell me how the same work can be done host wise.

Tags (1)
0 Karma
Highlighted

Re: grouping by host

Champion

please check this -

index=ck sourcetype=a_log host = hkv earliest=-6h | delta du as useddiff |
fillnull value=0.00 useddiff | timechart eval(useddiff/15) by host

0 Karma
Highlighted

Re: grouping by host

Explorer

the problem is since I have more than 1 host and i need the difference for the same host or a zero rather than calculating a difference between the last value of the previous host and the first value of the next host

0 Karma
Highlighted

Re: grouping by host

Champion

maybe, instead of delta, you can give it a try for stats dc (distinct count)-

index=ck sourcetype=a_log host = hkv earliest=-6h | stats dc(du) as useddiff by host | fillnull value=0.00 useddiff | eval velo=useddiff/15| table time du useddiff velo 
0 Karma
Highlighted

Re: grouping by host

Explorer

But this defeats the purpose since I actually need the difference between the two rather consecutive rows belonging to the same host only.

0 Karma
Highlighted

Re: grouping by host

SplunkTrust
SplunkTrust

Give this a try

index=ck sourcetype=a_log host=* earliest=-6h 
| sort 0 _time host
| streamstats current=f window=1 values(du) as prevdu by host
| eval useddiff=coalesce(du-prevdu,0.00) 
| eval velo=useddiff/15 | table _time du useddiff velo

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.