Splunk Enterprise

streamstats and delta

tb5821
Communicator

My search brings back data in a table like so:

_time|product|count
8/15/15 08:00:00|apples|500
8/15/15 08:00:00|oranges|800
8/15/15 08:00:00|plums|200
8/15/15 08:00:00|peaches|275

What I want is to have splunk compute the diff between the latest value above and the one just before it per product. So it ends up like:

8/15/15 08:00:00|apples|500|+50
8/15/15 08:00:00|oranges|800|+200
8/15/15 08:00:00|plums|200|-2
8/15/15 08:00:00|peaches|275|+80

Pretty sure I need to use streamstats and delta but can't get the combo right.

1 Solution

kmaron
Motivator

it sounds like your question is like this one: https://answers.splunk.com/answers/329534/how-to-determine-the-delta-between-events-based-on.html

So based on that answer you could try this:

 | streamstats current=f last(count) as last_count by product
 | rename count as current_count
 | eval delta = last_count - current_count
 | table _time product current_count delta

View solution in original post

kmaron
Motivator

it sounds like your question is like this one: https://answers.splunk.com/answers/329534/how-to-determine-the-delta-between-events-based-on.html

So based on that answer you could try this:

 | streamstats current=f last(count) as last_count by product
 | rename count as current_count
 | eval delta = last_count - current_count
 | table _time product current_count delta
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...