Splunk Search

Comparing information based on _time and calculated value

Brainstorms
Explorer

I have looked for solutions but I have mostly found results regarding only current and past time comparison which is not what I need.

I have a query that bins _time by 24h spans over the previous 7 days. and calculates a numeric value associated with those time spans. What I need is to compare each day's values to the entire week's and find any time period (so 48h) where the number jumped significantly. 

An example of something similar to my my code:

index=sandwiches saved_search_name="yum" earliest=-7d
| bin span=24h _time
| search sandwich_type="PB&J"
| stats count by total_bread_type _time
| stats sum(total_bread_type) as bread by _time
| eval bread = round(bread / 10000, 2)

currently the results are like this:

_timebread
2021-12-22 18:0022
2021-12-23 18:0023
2021-12-24 18:0021
2021-12-25 18:0047
2021-12-26 18:0048
2021-12-27 18:0046
2021-12-28 18:0047


Basically I am looking to compare the 'bread' values by _time and figure out if/where there is a jump of 10 or more and return that data.

Any insight would be appreciated. Thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this.  The streamstats command takes the difference between adjacent results then we filter for a jump of more than 10.

index=sandwiches saved_search_name="yum" earliest=-7d
| bin span=24h _time
| search sandwich_type="PB&J"
| stats count by total_bread_type _time
| stats sum(total_bread_type) as bread by _time
| eval bread = round(bread / 10000, 2)
| streamstats window=2 range(bread) as diff
| where diff > 10
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this.  The streamstats command takes the difference between adjacent results then we filter for a jump of more than 10.

index=sandwiches saved_search_name="yum" earliest=-7d
| bin span=24h _time
| search sandwich_type="PB&J"
| stats count by total_bread_type _time
| stats sum(total_bread_type) as bread by _time
| eval bread = round(bread / 10000, 2)
| streamstats window=2 range(bread) as diff
| where diff > 10
---
If this reply helps you, Karma would be appreciated.

Brainstorms
Explorer

That did the trick! Thank you so much Rich.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...