Re: math operations between events

cl3513 · ‎07-09-2021

I am using snmp to poll interface stats from a device, which is only returning total packets received on interface, I am polling every 60 seconds. Is there any way in dashboard to take the difference between those values and then divide by 60t to get packets per second and display this value in dashboard? (<event1 value> - event2 value>)/60. Dashboard would need to do this for each event coming in.

richgalloway · ‎07-09-2021

The streamstats command can give you the difference of a field between events. Then use eval to do the division.

... | streamstats window=2 range(foo) as diff
| eval diff=diff/60

---
If this reply helps you, Karma would be appreciated.

math operations between events

timechart

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation