I'm pretty new to Splunk and have been messing around with searches. However, I am struggling to get to grips with what I want to do. Is anyone able to help me please?
For this data:
20181012-163322 IagoAspas 2.15 2.09 190 Forward 78 CeltaVigo
We have the following fields:
Date Name BP SP Rank Position PosRank Club
This data gets ingested 3 times a minute, at 20 second intervals. The BP, SP, Rank & PosRank fields can change with each result.
If I wanted to compare the BP field over time for every result where Name is equal to IagoAspas, how could I do this, and then:
a) plot it on a line graph
and
b) alert when the BP field value has increased by 5% in the last 10 minutes worth of results (i.e. 3 results a minute, 30 results every 10)
@luke222010,
Does this work for you ?
a . "your search to get the fields"|chart values(BP) over Date by Name
b. "your search to get the fields" |stats first(BP) as start,last(BP) as last by Name|eval diff=((last-start)/start)*100|where diff > 5
Sample data used
Date, Name, BP, SP, Rank ,Position ,PosRank ,Club
2018-10-12 16:33:20,IagoAspas,2.15,2.09,190,Forward,78,CeltaVigo
2018-10-12 16:33:40,IagoAspas1,2.14,2.09,190,Forward,78,CeltaVigo
2018-10-12 16:34:00,IagoAspas,2.11,2.1,190,Forward,78,CeltaVigo
2018-10-12 16:34:20,IagoAspas1,2.13,2.1,190,Forward,78,CeltaVigo
2018-10-12 16:34:40,IagoAspas,2.13,2.1,190,Forward,78,CeltaVigo
2018-10-12 16:35:00,IagoAspas,2.2,2.1,190,Forward,78,CeltaVigo
@luke222010,
Does this work for you ?
a . "your search to get the fields"|chart values(BP) over Date by Name
b. "your search to get the fields" |stats first(BP) as start,last(BP) as last by Name|eval diff=((last-start)/start)*100|where diff > 5
Sample data used
Date, Name, BP, SP, Rank ,Position ,PosRank ,Club
2018-10-12 16:33:20,IagoAspas,2.15,2.09,190,Forward,78,CeltaVigo
2018-10-12 16:33:40,IagoAspas1,2.14,2.09,190,Forward,78,CeltaVigo
2018-10-12 16:34:00,IagoAspas,2.11,2.1,190,Forward,78,CeltaVigo
2018-10-12 16:34:20,IagoAspas1,2.13,2.1,190,Forward,78,CeltaVigo
2018-10-12 16:34:40,IagoAspas,2.13,2.1,190,Forward,78,CeltaVigo
2018-10-12 16:35:00,IagoAspas,2.2,2.1,190,Forward,78,CeltaVigo