Hello everyone,
I am completely new to splunk,. I have a Dashboard requirement where I need to display the difference of the first column of numbers every 15 minutes. The log is updating every 10-15 minutes in real time. For ex: first record in the graph should be 99( 1100-1001)
2018-04-21 00:00:00 INFO Switching to next trail file due to EOF
1001 abc done on 2018-04-21 00:45:38
1100 agc done on 2018-04-21 00:55:30
1200 ybc done on 2018-04-21 01:05:39
...................................
.....................................
2400 bcd done on 2018-04-21 10:40:38
Please assist in how I can achieve this.
Thanks,
Naomi
I got it working. Thanks
Try this:
| makeresults
| eval raw = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39"
| eval raw = split(raw, ",")
| mvexpand raw
| rename raw AS _raw
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| rex "(?<value>\d+)\s+(?<which>\S+)\s+\S+\s+on\s+(?<_time>[^,]+)"
| eval _time = strptime(_time, "%Y-%m-%d %H:%M:%S")
| sort 0 - _time
| reverse
| delta value
| reverse
Hope this search satisfies your requirement
|makeresults | eval event = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" |eval event = split(event, ",")|mvexpand event| rex field=event "(?\d+)\s+(?P\w+)\s+(?P\w+)" |delta first as firstcolumndiff