Dashboards & Visualizations

Calculation in Dashboard

naomibn
Explorer

Hello everyone,

I am completely new to splunk,. I have a Dashboard requirement where I need to display the difference of the first column of numbers every 15 minutes. The log is updating every 10-15 minutes in real time. For ex: first record in the graph should be 99( 1100-1001)

2018-04-21 00:00:00 INFO Switching to next trail file due to EOF
1001 abc done on 2018-04-21 00:45:38
1100 agc done on 2018-04-21 00:55:30
1200 ybc done on 2018-04-21 01:05:39
...................................
.....................................
2400 bcd done on 2018-04-21 10:40:38

Please assist in how I can achieve this.

Thanks,
Naomi

0 Karma

naomibn
Explorer

I got it working. Thanks

0 Karma

woodcock
Esteemed Legend

Try this:

| makeresults 
| eval raw = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" 
| eval raw = split(raw, ",") 
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "(?<value>\d+)\s+(?<which>\S+)\s+\S+\s+on\s+(?<_time>[^,]+)"
| eval _time = strptime(_time, "%Y-%m-%d %H:%M:%S")
| sort 0 - _time
| reverse
| delta value
| reverse
0 Karma

ssadanala1
Contributor

Hope this search satisfies your requirement

|makeresults | eval event = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" |eval event = split(event, ",")|mvexpand event| rex field=event "(?\d+)\s+(?P\w+)\s+(?P\w+)" |delta first as firstcolumndiff

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...