Splunk Search

How to check continuous increase of values of a field.

Anantha123
Communicator

Please help me on how I can check if the field value is continuously increasing for 3 hours. 

tried below query but does not help . 

Perc_change values are extracted from logs , whereas prev_change and growing are calculated form perc_change values.

| streamstats current=f window=1 latest(perc_change) as prev_value
| fillnull value=0
| eval growing = if(perc_change< prev_value,1,0)
| table _time GB change perc_change prev_value growing

getting values as 

perc_change  prev_value  growing

60                          0                    0

35                         60                  1

33                         35                    1

150                       33                   0 

expectations : 

perc_change  prev_value  growing

60                         35                  1

35                         33                  1

33                         150               0

150                       0                    0

 I have to send a report if the perc_change values are continuously growing for 3 hours

Appreciate your help . Thank you.

 

Labels (3)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| reverse
| streamstats current=f window=1 latest(perc_change) as prev_value
| reverse
| fillnull value=0
| eval growing = if(perc_change< prev_value,1,0)
| table _time GB change perc_change prev_value growing
0 Karma

yuanliu
SplunkTrust
SplunkTrust

First of all, I suspect that by "continuous increase" you actually mean monotonous increase.  Are you thinking of delta instead?  What is the output format you need in the report?  If you want all the event details, you can then use eventstats to determine whether there was any decrement.

| delta perc_change as delta
| eventstats values(delta) as change
| where NOT changes < 0
| table _time GB delta perc_change

If you do not need every event, you may construct some stats command that is more efficient.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...