Splunk Search

How to edit my search to find the difference of a field from a previous poll, find the per second value, and display it on a timechart over 1 hour?


I've scoured the Docs and Answers and haven't had any luck modifying their solutions to fit mine including streamstats and range. So here goes...

I'm using Splunk ver 6.2.0.
There is a script that runs every 5 min and returns several "fields". One such field increments errors, which I want to plot the DELTA of the previous poll as "errors per second" over the span of 1hr or more.

So I need it to take the difference of the previous poll, derive the per second value, then display it plotted over 1hr. Eventually, I would like to alert on those whose Delta crosses a threshold.

I've changed the search a million times, but this search string plotted both Errors AND the Difference. The difference value is so low that the Errors overpower it. I'm only interested in plotting the Difference, not the Errors, per se.

source=mysource  location=place1 car_Id=72 md_Id=61 | search "ErrCount" | timechart span=5m median(ErrCount) as Errors | delta Errors as difference
0 Karma


I may have gotten this to work using...

|sort + _time| delta ErrCount as difference | timechart span=5m per_second(difference) by xyz useother=f usenull=f

I'll follow up later if this has answered my own question.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...