Knowledge Management

How to calculate the daily change of a field value

DMohn
Motivator

Hi Splunkers,

I need to calculate the daily value change of a field, and report on the daily difference. The field is just an event counter, that gets increased every time the event is triggered. Events come in at no particular frequency.

Example Data:
20151231-235955 foo bar 211
20160101-000304 foo bar 212
20160101-000402 foo baz 213
20160101-020543 foo bar 213
.....
20160101-235812 foo baz 278
20160102-000919 foo bar 278

Now I need to create a table (timechart, whatever) of the daily changes of the counter. For Jan, 01 2016 it should read 67 (211 as last count of the previous day, 278 as last event of the actual day).

I am not sure how to do this. I already tried using streamstats and counting the changes of the field, but I don't know how to reset the streamstats value each day.

Can someone point me in the right direction?

Thanks!

0 Karma
1 Solution

javiergn
Super Champion

This is what I would do:

yoursearch 
| bucket span=1d _time
| stats max(event_counter) as dailymax, min(event_counter) as dailymin by _time
| eval dailydiff = dailymax - dailymin

View solution in original post

renjith_nair
Legend

Try this. This should give you the difference for a week per day

...your search earliest=-7d@d
| bucket _time span=1d
| stats earliest(_time) as FirstTime,earliest(counter) as FirstCounter, latest(_time) as LastTime,latest(counter) as LastCCounter
   by _time
 |eval Difference=LastCCounter-FirstCounter
|table FirstTime FirstCounter LastTime LastCounter Difference

Please test it with your events

Also refer to http://docs.splunk.com/Documentation/Splunk/6.2.0/Search/Specifytimemodifiersinyoursearch

---
What goes around comes around. If it helps, hit it with Karma 🙂

javiergn
Super Champion

This is what I would do:

yoursearch 
| bucket span=1d _time
| stats max(event_counter) as dailymax, min(event_counter) as dailymin by _time
| eval dailydiff = dailymax - dailymin

DMohn
Motivator

Sometimes it's so simple you just don't see the obvious 🙂

Thanks a lot, that's what I needed!

0 Karma

kbarker302
Communicator
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...