Reporting

looking for a counter that decreases

tedder
Communicator

I have a field that should be increasing - though not monotonically increasing.

a=1
a=4
a=9
a=13
a=14
a=10
a=101

I want to alert if the number gets smaller. Here's my attempt at this.

index="myindex" | stats max(a) as maxnum | where a < maxnum

That doesn't find it because the number never decreases below 101. However, even if I change the query, it doesn't find any rows!

index="myindex" | stats max(a) as maxnum | where a < (maxnum-100)

Obviously, that doesn't do what I want. But it was an interesting diagnosis. I was inspired by this question, but I can't change it to do what I want. Can/should I do this with a subsearch?

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this with "delta" search operator.

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Basically, do a search similar to:

index="myindex" | delta a as a_delta | where a_delta < 0

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this with "delta" search operator.

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Basically, do a search similar to:

index="myindex" | delta a as a_delta | where a_delta < 0

tedder
Communicator

delta is precisely what I needed. Streamstats might too, but delta was even easier!

0 Karma

southeringtonp
Motivator

You could do it with streamstats too, but delta is the simplest approach.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...