Splunk Search

Find rate from total

Communicator

I want to take a totals field. And display the rate on a chart.

For example:

Total = 0, 1, 2, 3, 4, 5, 6, 7, 9, 10

Rate = 0, 1, 1, 1, 1, 1, 1, 1, 2, 1.

                              __
        _____________________/  \__   
   ____/

Take that as a rough guide anyway. I have looked through List(X) to see all my values which works, but I cannot figure out how you subtract the Last(X) value from the 'LastMinusOne(X)' value...

Thanks - and sorry for the crude graph 🙂

1 Solution

Influencer

I think the delta command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

  ... | delta total as rate | eval rate=coalesce(rate,0)

View solution in original post

Influencer

I think the delta command is what you're looking for:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

  ... | delta total as rate | eval rate=coalesce(rate,0)

View solution in original post

Communicator

Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!