Splunk Search

How do I prevent initial delta value from breaking my visualization?

EricLloyd79
Builder

I am trying to get the delta of several key-value pairs over a period of an hour. The initial ingestion of data is from a few hours ago yet the earliest time slot for this timechart is empty and the second one has the full value (not the delta) causing my visualizations to be unreadable. I see what its doing - its basically trying to get the previous value for the earliest time slot for the time I've specified, seeing it empty and giving me the delta of the full value but I need it to recognize the previous value, instead of it being blank.

Here is a template for my query:
sourcetype=abc SCTP host="abc.com"

| timechart span=5m max(field1) as field1 max(field2) as field2
| delta field1 as field1d
| delta field2 as field2d

So my output in stats is :
FIRST ROW TIMESLOT: BLANK
SECOND ROW TIMESLOT: field1=2000 field2=5000
THIRD ROW TIMESLOT: field1=0 field2=3

So now my visualization is unreadable...

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

sourcetype=abc SCTP host="abc.com" | bucket span=5m _time | stats max(field1) as field1 max(field2) as field2 by _time
| delta field1 as field1d
| delta field2 as field2d

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

sourcetype=abc SCTP host="abc.com" | bucket span=5m _time | stats max(field1) as field1 max(field2) as field2 by _time
| delta field1 as field1d
| delta field2 as field2d
0 Karma

sundareshr
Legend

Are these values for field1d or field1? Why is the first timeslot blank for field1? I can understand it being blank for field1d. What would you like the "previous value" for the first row be?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...