How to calculate rate of change over time for an variable

[mflamerich]

I have an input value that changes steadily (at constant rate, either increasing or decreasing), and Splunk is capturing every value with a timestamp.

I am trying to find a way to calculate the acceleration of this input, which is the rate of change over time.
Ideally, I would like to trigger an alert if a threshold in this rate of change is reached.

Any smooth changes in the velocity are fine, but abrupt changes (speed up, slow down larger than some threshold) should trigger an alarm, or at least should be visible in a Splunk graph for analysis against other kind of time based data for event correlation analysis.

Mathematically, the problem should be simple: Acceleration is the second derivative of a function.
However, it is difficult to model a function (much less find the derivatives) from just raw data.

I might be over-thinking this, therefore I'm reaching out to other splunkers for ideas.

Thanks.

[kristian_kolb]

If you are talking about a steady increase/decrease (not acceleration) delta would be a good option.

If you are talking about acceleration/deceleration hmm .. perhaps would be something that you can work on.

... | streamstats window=X stdev(your_field) as Y

Large values of Y would indicate that there has been a significant change, and that the current value of your_field is different from the previous X number of values.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonStatsFunctions
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Streamstats

/k