Splunk Search

How to evaluate an arithmetic difference between two consecutive events

rootto
Explorer

Hi all,

I would like to evaluate the difference between two events (in theory the events contain completely different data). Let's say I have the following events:

timestap1 81 115 42683 1267 0 0
timestap2 81 107 42683 1267 0 0

the third column corresponds to the field Total_Sent and I want to raise an alert if the field is not growing. How can I do: Toal_Sent1 - Total_Sent2 (in my case 42683 - 42683) and check if the result is greater than 5 ?

Thanks from a splunk newbie

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Have you tried the "delta" search operator?

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Delta will find the different between the same extracted field in consecutive events. You will probably need to define field extractions for your fields in order to be able to use delta against them.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Have you tried the "delta" search operator?

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Delta will find the different between the same extracted field in consecutive events. You will probably need to define field extractions for your fields in order to be able to use delta against them.

rootto
Explorer

Thanks I implemented it doing

| delta Total_Sent AS diffsent | search diffsent > 5

and it works. Do you know if I can limit the search to the last two events? I tried to pipe | head 2 | but it doesn't help.

Thanks again

0 Karma

alanden_splunk
Splunk Employee
Splunk Employee

The last two results (after diffsent>5 filter) would look like:

| delta Total_Sent AS diffsent | search diffsent > 5 | head 2

The last two events would look like this:

| head 2 | delta Total_Sent AS diffsent | search diffsent > 5
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...