Splunk Search

How to calculate rate of change over time for an variable

mflamerich
Explorer

I have an input value that changes steadily (at constant rate, either increasing or decreasing), and Splunk is capturing every value with a timestamp.

I am trying to find a way to calculate the acceleration of this input, which is the rate of change over time.
Ideally, I would like to trigger an alert if a threshold in this rate of change is reached.

Any smooth changes in the velocity are fine, but abrupt changes (speed up, slow down larger than some threshold) should trigger an alarm, or at least should be visible in a Splunk graph for analysis against other kind of time based data for event correlation analysis.

Mathematically, the problem should be simple: Acceleration is the second derivative of a function.
However, it is difficult to model a function (much less find the derivatives) from just raw data.

I might be over-thinking this, therefore I'm reaching out to other splunkers for ideas.

Thanks.

Tags (2)

kristian_kolb
Ultra Champion

If you are talking about a steady increase/decrease (not acceleration) delta would be a good option.

If you are talking about acceleration/deceleration hmm .. perhaps would be something that you can work on.

... | streamstats window=X stdev(your_field) as Y

Large values of Y would indicate that there has been a significant change, and that the current value of your_field is different from the previous X number of values.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonStatsFunctions
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Streamstats

/k

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...