Splunk Search

Find rate from total

matthewcanty
Communicator

I want to take a totals field. And display the rate on a chart.

For example:

Total = 0, 1, 2, 3, 4, 5, 6, 7, 9, 10

Rate = 0, 1, 1, 1, 1, 1, 1, 1, 2, 1.

                              __
        _____________________/  \__   
   ____/

Take that as a rough guide anyway. I have looked through List(X) to see all my values which works, but I cannot figure out how you subtract the Last(X) value from the 'LastMinusOne(X)' value...

Thanks - and sorry for the crude graph 🙂

1 Solution

ziegfried
Influencer

I think the delta command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

  ... | delta total as rate | eval rate=coalesce(rate,0)

View solution in original post

ziegfried
Influencer

I think the delta command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

  ... | delta total as rate | eval rate=coalesce(rate,0)

matthewcanty
Communicator

Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...