Splunk Search

How to calculate rate of change over time for an variable

mflamerich
Explorer

I have an input value that changes steadily (at constant rate, either increasing or decreasing), and Splunk is capturing every value with a timestamp.

I am trying to find a way to calculate the acceleration of this input, which is the rate of change over time.
Ideally, I would like to trigger an alert if a threshold in this rate of change is reached.

Any smooth changes in the velocity are fine, but abrupt changes (speed up, slow down larger than some threshold) should trigger an alarm, or at least should be visible in a Splunk graph for analysis against other kind of time based data for event correlation analysis.

Mathematically, the problem should be simple: Acceleration is the second derivative of a function.
However, it is difficult to model a function (much less find the derivatives) from just raw data.

I might be over-thinking this, therefore I'm reaching out to other splunkers for ideas.

Thanks.

Tags (2)

kristian_kolb
Ultra Champion

If you are talking about a steady increase/decrease (not acceleration) delta would be a good option.

If you are talking about acceleration/deceleration hmm .. perhaps would be something that you can work on.

... | streamstats window=X stdev(your_field) as Y

Large values of Y would indicate that there has been a significant change, and that the current value of your_field is different from the previous X number of values.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonStatsFunctions
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Streamstats

/k

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...