Hi,
I am new to splunk, and am trying to generate a search that calculates the change in paging space usage over a period of time. The search below makes that calculation for one host, but I would like to run a report that sorts all hosts based on how much paging space increases from one time period to the next.
Is that possible with this search as a base, or am I heading in the wrong direction.
Thanks,
Kevin
current search:
#pagejob# index=midrange host=nc2txwas310 | stats first(Used) as firstUsed, last(Used) as lastUsed | eval diffUsed=firstUsed-lastUsed
Sample data:
"Fri Dec 19 23:36:13 EST 2014","nc2txwas310","#pagejob#","Paging","Space=15360","Paging Used=44"
"Thu Dec 18 20:53:47 EST 2014","nc2txwas310","#pagejob#","Paging","Space=15360","Paging Used=38"
"Fri Dec 19 23:36:13 EST 2014","nc2txwas199","#pagejob#","Paging","Space=15360","Paging Used=55"
"Thu Dec 18 20:53:47 EST 2014","nc2txwas199","#pagejob#","Paging","Space=15360","Paging Used=22"
Hey Kevin,
I would probably do a "max" and a "min" on the Used field for the time period, then find the difference. I'm not sure it matters when the min or max occurred from your description. So it would be something like this:
index=midrange | stats max(Used) as maxUsed, min(Used) as minUsed by host | eval diffUsed=maxUsed-minUsed | table host, diffUsed | sort - diffUsed
Hey Kevin,
I would probably do a "max" and a "min" on the Used field for the time period, then find the difference. I'm not sure it matters when the min or max occurred from your description. So it would be something like this:
index=midrange | stats max(Used) as maxUsed, min(Used) as minUsed by host | eval diffUsed=maxUsed-minUsed | table host, diffUsed | sort - diffUsed