Dashboards & Visualizations

Calculation in Dashboard

naomibn
Explorer

Hello everyone,

I am completely new to splunk,. I have a Dashboard requirement where I need to display the difference of the first column of numbers every 15 minutes. The log is updating every 10-15 minutes in real time. For ex: first record in the graph should be 99( 1100-1001)

2018-04-21 00:00:00 INFO Switching to next trail file due to EOF
1001 abc done on 2018-04-21 00:45:38
1100 agc done on 2018-04-21 00:55:30
1200 ybc done on 2018-04-21 01:05:39
...................................
.....................................
2400 bcd done on 2018-04-21 10:40:38

Please assist in how I can achieve this.

Thanks,
Naomi

0 Karma

naomibn
Explorer

I got it working. Thanks

0 Karma

woodcock
Esteemed Legend

Try this:

| makeresults 
| eval raw = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" 
| eval raw = split(raw, ",") 
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "(?<value>\d+)\s+(?<which>\S+)\s+\S+\s+on\s+(?<_time>[^,]+)"
| eval _time = strptime(_time, "%Y-%m-%d %H:%M:%S")
| sort 0 - _time
| reverse
| delta value
| reverse
0 Karma

ssadanala1
Contributor

Hope this search satisfies your requirement

|makeresults | eval event = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" |eval event = split(event, ",")|mvexpand event| rex field=event "(?\d+)\s+(?P\w+)\s+(?P\w+)" |delta first as firstcolumndiff

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...