How to create a report that sorts all hosts based on how much a value increases from one time period to the next?

[kevinwyrick]

Hi,

I am new to splunk, and am trying to generate a search that calculates the change in paging space usage over a period of time. The search below makes that calculation for one host, but I would like to run a report that sorts all hosts based on how much paging space increases from one time period to the next.
Is that possible with this search as a base, or am I heading in the wrong direction.

Thanks,

Kevin

current search:

#pagejob# index=midrange host=nc2txwas310  | stats first(Used) as firstUsed, last(Used) as lastUsed | eval diffUsed=firstUsed-lastUsed

Sample data:

"Fri Dec 19 23:36:13 EST 2014","nc2txwas310","#pagejob#","Paging","Space=15360","Paging Used=44"
"Thu Dec 18 20:53:47 EST 2014","nc2txwas310","#pagejob#","Paging","Space=15360","Paging Used=38"
"Fri Dec 19 23:36:13 EST 2014","nc2txwas199","#pagejob#","Paging","Space=15360","Paging Used=55"
"Thu Dec 18 20:53:47 EST 2014","nc2txwas199","#pagejob#","Paging","Space=15360","Paging Used=22"

[jimodonald · Accepted solution]

Hey Kevin,

I would probably do a "max" and a "min" on the Used field for the time period, then find the difference. I'm not sure it matters when the min or max occurred from your description. So it would be something like this:

index=midrange | stats max(Used) as maxUsed, min(Used) as minUsed by host | eval diffUsed=maxUsed-minUsed | table host, diffUsed | sort - diffUsed