Splunk Search

How to check continuous increase of values of a field.

Anantha123
Communicator

Please help me on how I can check if the field value is continuously increasing for 3 hours. 

tried below query but does not help . 

Perc_change values are extracted from logs , whereas prev_change and growing are calculated form perc_change values.

| streamstats current=f window=1 latest(perc_change) as prev_value
| fillnull value=0
| eval growing = if(perc_change< prev_value,1,0)
| table _time GB change perc_change prev_value growing

getting values as 

perc_change  prev_value  growing

60                          0                    0

35                         60                  1

33                         35                    1

150                       33                   0 

expectations : 

perc_change  prev_value  growing

60                         35                  1

35                         33                  1

33                         150               0

150                       0                    0

 I have to send a report if the perc_change values are continuously growing for 3 hours

Appreciate your help . Thank you.

 

Labels (4)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| reverse
| streamstats current=f window=1 latest(perc_change) as prev_value
| reverse
| fillnull value=0
| eval growing = if(perc_change< prev_value,1,0)
| table _time GB change perc_change prev_value growing
0 Karma

yuanliu
SplunkTrust
SplunkTrust

First of all, I suspect that by "continuous increase" you actually mean monotonous increase.  Are you thinking of delta instead?  What is the output format you need in the report?  If you want all the event details, you can then use eventstats to determine whether there was any decrement.

| delta perc_change as delta
| eventstats values(delta) as change
| where NOT changes < 0
| table _time GB delta perc_change

If you do not need every event, you may construct some stats command that is more efficient.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...