Splunk Search

How to edit search so delta command does not return negative results?

NaorPenso
Explorer

Hi Everyone,
I have a need to create a delta between the count of id today to the count of id yesterday
search: search xyz| timechart count span=1d | sort - _time | delta count AS countdiff
example result:

    _time   count   countdiff
2014-08-26T00:00:00.000+0300    4   
2014-08-25T00:00:00.000+0300    1   -3
2014-08-24T00:00:00.000+0300    0   -1
2014-08-23T00:00:00.000+0300    0   0
2014-08-22T00:00:00.000+0300    0   0
2014-08-21T00:00:00.000+0300    0   0
2014-08-20T00:00:00.000+0300    0   0
2014-08-19T00:00:00.000+0300    0   0
2014-08-18T00:00:00.000+0300    0   0
2014-08-17T00:00:00.000+0300    0   0
2014-08-16T00:00:00.000+0300    0   0
2014-08-15T00:00:00.000+0300    0   0
2014-08-14T00:00:00.000+0300    0   0
2014-08-13T00:00:00.000+0300    0   0
2014-08-12T00:00:00.000+0300    1   1
2014-08-11T00:00:00.000+0300    0   -1

using delta i was able to create the diff between today and the day before but the delta function does yesterday-today and i need it today-yesterday.
Any thoughts?

Tags (3)
1 Solution

norbert_hamel
Communicator

Maybe you want to remove the | sort - _time, or put is behind the diff command.

search xyz| timechart span=1min count | delta count AS countdiff | sort - _time

Cheers
Norbert

View solution in original post

norbert_hamel
Communicator

Maybe you want to remove the | sort - _time, or put is behind the diff command.

search xyz| timechart span=1min count | delta count AS countdiff | sort - _time

Cheers
Norbert

NaorPenso
Explorer

Thank Norbert!
Delta before the diff did return positive values.
Thanks again,
Naor

0 Karma

DerekKing
Path Finder

Hi,

What about

search xyz| timechart count span=1d | reverse | delta count AS countdiff

Regards
Derek

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...