Splunk Search

How to create a report that sorts all hosts based on how much a value increases from one time period to the next?

kevinwyrick
Engager

Hi,

I am new to splunk, and am trying to generate a search that calculates the change in paging space usage over a period of time. The search below makes that calculation for one host, but I would like to run a report that sorts all hosts based on how much paging space increases from one time period to the next.
Is that possible with this search as a base, or am I heading in the wrong direction.

Thanks,

Kevin

current search:

#pagejob# index=midrange host=nc2txwas310  | stats first(Used) as firstUsed, last(Used) as lastUsed | eval diffUsed=firstUsed-lastUsed

Sample data:

"Fri Dec 19 23:36:13 EST 2014","nc2txwas310","#pagejob#","Paging","Space=15360","Paging Used=44"
"Thu Dec 18 20:53:47 EST 2014","nc2txwas310","#pagejob#","Paging","Space=15360","Paging Used=38"
"Fri Dec 19 23:36:13 EST 2014","nc2txwas199","#pagejob#","Paging","Space=15360","Paging Used=55"
"Thu Dec 18 20:53:47 EST 2014","nc2txwas199","#pagejob#","Paging","Space=15360","Paging Used=22"
Tags (4)
1 Solution

jimodonald
Contributor

Hey Kevin,

I would probably do a "max" and a "min" on the Used field for the time period, then find the difference. I'm not sure it matters when the min or max occurred from your description. So it would be something like this:

index=midrange | stats max(Used) as maxUsed, min(Used) as minUsed by host | eval diffUsed=maxUsed-minUsed | table host, diffUsed | sort - diffUsed

View solution in original post

jimodonald
Contributor

Hey Kevin,

I would probably do a "max" and a "min" on the Used field for the time period, then find the difference. I'm not sure it matters when the min or max occurred from your description. So it would be something like this:

index=midrange | stats max(Used) as maxUsed, min(Used) as minUsed by host | eval diffUsed=maxUsed-minUsed | table host, diffUsed | sort - diffUsed
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...