This log is updated every 5 minutes (I have included three examples of the logs). The value is cumulative. So, while graphing it in Splunk, I have to deduct the previous value to get the value for that 5 minute interval. So for example, lets take one field, pdweb.sescache
hit has the following three values of 26965624, 27089514, and 27622280.
Taking 27622280-27089514 = 532766 (this is the actual value I want for that 5 minute interval.)
2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 26965624
2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 27089514
2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 27622280
Use the delta command:
index=main pdweb | delta pdweb.sescache as hits | timechart last(hits)
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delta
Use the delta command:
index=main pdweb | delta pdweb.sescache as hits | timechart last(hits)
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delta
Something like below should work for you
... | delta pdweb.sescache AS cache p=1 | timechart avg(cache)