Reporting

looking for a counter that decreases

tedder
Communicator

I have a field that should be increasing - though not monotonically increasing.

a=1
a=4
a=9
a=13
a=14
a=10
a=101

I want to alert if the number gets smaller. Here's my attempt at this.

index="myindex" | stats max(a) as maxnum | where a < maxnum

That doesn't find it because the number never decreases below 101. However, even if I change the query, it doesn't find any rows!

index="myindex" | stats max(a) as maxnum | where a < (maxnum-100)

Obviously, that doesn't do what I want. But it was an interesting diagnosis. I was inspired by this question, but I can't change it to do what I want. Can/should I do this with a subsearch?

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this with "delta" search operator.

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Basically, do a search similar to:

index="myindex" | delta a as a_delta | where a_delta < 0

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this with "delta" search operator.

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Basically, do a search similar to:

index="myindex" | delta a as a_delta | where a_delta < 0

tedder
Communicator

delta is precisely what I needed. Streamstats might too, but delta was even easier!

0 Karma

southeringtonp
Motivator

You could do it with streamstats too, but delta is the simplest approach.

Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...