Splunk Search

How to display rate from field value

matthewcanty
Communicator

Very new to this pipeline way of thinking, so apologies if this is trivial...

I am logging every 10 seconds the total number of X which have been cached. So this is incremental: 1, 2, 5, 8, 9, 15 etc. So each log message contains the following TotalCached=x where x is the number cached.

Now I want to chart the rate at which they are being cached. For the range of numbers above, I would like to see the values 0, 1, 3, 3, 1, 6 on a timechart.

I have been told to look at delta and streamstats to no avail.

EDIT

This is close to what I want:

source="..." FeedSource="PinnacleApi" SportId="Football" | delta TotalFixtures p=1 as fixDelta | timechart sum(fixDelta)

However I'd like to take off the FeedSource and SportId, and have the timechart display results by FeedSource or SportId. When I do do this it makes some strange results!

0 Karma
1 Solution

matthewcanty
Communicator

Changed the way we are logging. Logged the rate instead of the total, then did per_second(X)

View solution in original post

0 Karma

matthewcanty
Communicator

Changed the way we are logging. Logged the rate instead of the total, then did per_second(X)

0 Karma
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...