Splunk Search

How to create query for count over time of a field value decreasing?

smahoney
Path Finder

I have metrics that are basically
_time host1 monitor_count=2
_time host1 monitor_count=1

This is over different hosts and dynamic monitor_count values.  What I want to do is make a query that counts the amount of times the monitor_count depreciated over a given time range.

So if host 1 throttles back and forth between 2 and 1, how many times did that happen?

I'm trying many options of streamstats with window=2 earliest(monitor_count) as prev_count by host, but that doesn't seem to be working.  When it drops from 2 to 1, a 1 is recorded for previous and current to that time range.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| sort 0 _time
| streamstats current=f window=1 earliest(monitor_count) as prev_count global=f by host
0 Karma

smahoney
Path Finder

That just returns the current value as the window is 1 and current is false.

I could never get streamstats to work so ended up using a join so set the monitor cap.  Its not optimal, but can't figure out why streamstats cant compare 2 numeric values in a window of 2.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Here is a runanywhere example showing that prev_count is the count from the previous host.

| gentimes start=-1 increment=1h 
| rename starttime as _time 
| eval monitor_count=random()%10
| eval host=mvindex(split("ABC",""),random()%3) 
| streamstats current=f window=1 earliest(monitor_count) as prev_count global=f by host
| fields _time host monitor_count prev_count
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...