How to subtract field values every 5 minutes and display these results on a graph?

[dperry]

This log is updated every 5 minutes (I have included three examples of the logs). The value is cumulative. So, while graphing it in Splunk, I have to deduct the previous value to get the value for that 5 minute interval. So for example, lets take one field, pdweb.sescache hit has the following three values of 26965624, 27089514, and 27622280.

Taking 27622280-27089514 = 532766 (this is the actual value I want for that 5 minute interval.)

2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 26965624

2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 27089514

2015-06-22-11:30:00.000-08:00I----- pdweb.sescache hit : 27622280

[jnicholsenernoc · Accepted solution]

Use the delta command:

index=main pdweb | delta pdweb.sescache as hits | timechart last(hits)

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/Delta

[pradeepkumarg]

Something like below should work for you

 
... | delta pdweb.sescache AS cache p=1 | timechart avg(cache)