Splunk Search

## Find rate from total

Communicator

I want to take a totals field. And display the rate on a chart.

For example:

Total = 0, 1, 2, 3, 4, 5, 6, 7, 9, 10

Rate = 0, 1, 1, 1, 1, 1, 1, 1, 2, 1.

``````                              __
_____________________/  \__
____/
``````

Take that as a rough guide anyway. I have looked through List(X) to see all my values which works, but I cannot figure out how you subtract the Last(X) value from the 'LastMinusOne(X)' value...

Thanks - and sorry for the crude graph 🙂

Tags (5)
1 Solution
Influencer

I think the `delta` command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

``````  ... | delta total as rate | eval rate=coalesce(rate,0)
``````
Influencer

I think the `delta` command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

``````  ... | delta total as rate | eval rate=coalesce(rate,0)
``````
Communicator

Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?

Don’t Miss Global Splunk
User Groups Week!