Dashboards & Visualizations

Calculation in Dashboard

naomibn
Explorer

Hello everyone,

I am completely new to splunk,. I have a Dashboard requirement where I need to display the difference of the first column of numbers every 15 minutes. The log is updating every 10-15 minutes in real time. For ex: first record in the graph should be 99( 1100-1001)

2018-04-21 00:00:00 INFO Switching to next trail file due to EOF
1001 abc done on 2018-04-21 00:45:38
1100 agc done on 2018-04-21 00:55:30
1200 ybc done on 2018-04-21 01:05:39
...................................
.....................................
2400 bcd done on 2018-04-21 10:40:38

Please assist in how I can achieve this.

Thanks,
Naomi

0 Karma

naomibn
Explorer

I got it working. Thanks

0 Karma

woodcock
Esteemed Legend

Try this:

| makeresults 
| eval raw = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" 
| eval raw = split(raw, ",") 
| mvexpand raw
| rename raw AS _raw

| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"

| rex "(?<value>\d+)\s+(?<which>\S+)\s+\S+\s+on\s+(?<_time>[^,]+)"
| eval _time = strptime(_time, "%Y-%m-%d %H:%M:%S")
| sort 0 - _time
| reverse
| delta value
| reverse
0 Karma

ssadanala1
Contributor

Hope this search satisfies your requirement

|makeresults | eval event = "1001 abc done on 2018-04-21 00:45:38,
1100 agc done on 2018-04-21 00:55:30,
1200 ybc done on 2018-04-21 01:05:39" |eval event = split(event, ",")|mvexpand event| rex field=event "(?\d+)\s+(?P\w+)\s+(?P\w+)" |delta first as firstcolumndiff

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...