Splunk Enterprise

streamstats and delta

tb5821
Communicator

My search brings back data in a table like so:

_time|product|count
8/15/15 08:00:00|apples|500
8/15/15 08:00:00|oranges|800
8/15/15 08:00:00|plums|200
8/15/15 08:00:00|peaches|275

What I want is to have splunk compute the diff between the latest value above and the one just before it per product. So it ends up like:

8/15/15 08:00:00|apples|500|+50
8/15/15 08:00:00|oranges|800|+200
8/15/15 08:00:00|plums|200|-2
8/15/15 08:00:00|peaches|275|+80

Pretty sure I need to use streamstats and delta but can't get the combo right.

1 Solution

kmaron
Motivator

it sounds like your question is like this one: https://answers.splunk.com/answers/329534/how-to-determine-the-delta-between-events-based-on.html

So based on that answer you could try this:

 | streamstats current=f last(count) as last_count by product
 | rename count as current_count
 | eval delta = last_count - current_count
 | table _time product current_count delta

View solution in original post

kmaron
Motivator

it sounds like your question is like this one: https://answers.splunk.com/answers/329534/how-to-determine-the-delta-between-events-based-on.html

So based on that answer you could try this:

 | streamstats current=f last(count) as last_count by product
 | rename count as current_count
 | eval delta = last_count - current_count
 | table _time product current_count delta
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...