Splunk Search

Difference between two perfmon counters from the same source to identify bottleneck

rholm01
Explorer

Counter 1 - Perfmon: Inbound Data rate

Counter 2  - Perfmon:Outbound Data rate

source="Perfmon:PostilionPostbridgeInterchanges"

My values look something like this:  0.007956853689073186

I am looking for the difference between the two counters and to reduce the number to 3 places behind the decimal point, if possible.

Labels (6)
0 Karma

tscroggins
Influencer

@rholm01 

This may work:

| streamstats current=f last(Value) as previous_Value by host counter
| eval delta_Value=round(Value - previous_Value, 3)

If you want the absolute difference:

| eval delta_Value=round(abs(Value - previous_Value), 3)

If you find Splunk's rounded values disagreeing with exact calculations, you can tell Splunk to use exact math to the limits of the operating environment's floating point precision:

| eval delta_Value=exact(round(abs(Value - previous_Value), 3))

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...