Splunk Search

Delta based on multiple inboxes

manderson7
Contributor

We've gotten a search to work that shows the delta between the number of messages in an inbox for a period of time:

 

<basesearch>
| bin _time span=5m
| stats max(Items) AS Max by _time
| delta Max as Delta
| fields _time Delta
| where Delta>=10

 

But I want to do this based on multiple inboxes, and delta is merging the inboxes together, so the values of each inbox are interfering with each other.

 

<basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max  by _time User
| delta Max as Delta
| fields _time Delta User

 

returns:

_timeUserMaxDelta
09:15user1103 
09:15user2251148
09:15user317-234

and I want the users to be treated as individual accounts, not merged with each other. 

I assume I need to use streamstats for this, but so far I've been unable to work out how.

Labels (2)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this query

<basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max  by _time User
| streamstats window=2 range(Max) as Delta by User
| fields _time Delta User
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this query

<basesearch multiple mailboxes>
| bin _time span=5m
| stats max(Items) AS Max  by _time User
| streamstats window=2 range(Max) as Delta by User
| fields _time Delta User
---
If this reply helps you, Karma would be appreciated.

manderson7
Contributor

That does the trick. Thanks so much.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...