Dashboards & Visualizations

How to subtract field values every 5 minutes and display these results on a graph?

dperry
Communicator

This log is updated every 5 minutes (I have included three examples of the logs). The value is cumulative. So, while graphing it in Splunk, I have to deduct the previous value to get the value for that 5 minute interval. So for example, lets take one field, pdweb.sescache hit has the following three values of 26965624, 27089514, and 27622280.

Taking 27622280-27089514 = 532766 (this is the actual value I want for that 5 minute interval.)

2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 26965624

2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 27089514

2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 27622280
Tags (3)
0 Karma
1 Solution

jnicholsenernoc
Path Finder

Use the delta command:

index=main pdweb | delta pdweb.sescache as hits | timechart last(hits)

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delta

View solution in original post

jnicholsenernoc
Path Finder

Use the delta command:

index=main pdweb | delta pdweb.sescache as hits | timechart last(hits)

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delta

pradeepkumarg
Influencer

Something like below should work for you

 
... | delta pdweb.sescache AS cache p=1 | timechart avg(cache)
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...