Splunk Search

How to find deltas for multiple fields generically

benobviate
Explorer

Currently, the query ... | timechart span=1hr count by term limit=10

gives me

_time apple orange banana

3:00pm 123 138 100

4:00pm 132 102 129

Is there a way to find the deltas of each term without naming each individual field in the query? The reason is because the field names (terms) may change (there are several hundred possible terms).

I only know how to do ... | delta apple p=1 as apple_d

but unfortunately, the apple term might be something else. So I am hoping for soemthing like ... | delta all_fields_except_time* p=1 as field_name_d

Ultimately I want a table like _time apple_d orange_ d banana_d

0 Karma

jonuwz
Influencer

finally a use for untable. !

(not really - it you don't do timechart 1st, you wont be in this predicament )

... | untable _time fruit count | streamstats current=false window=1 global=false first(count) as p_count by fruit | eval delta=p_count-count | xyseries _time fruit delta

realistically, you would do the streamstats, manually calculate the delta, then do timechart on the delta field

martin_mueller
SplunkTrust
SplunkTrust

This will give the absolute delta, with no indication of which value is bigger:

... | streamstats range(*) window=2

The delta command does indeed not like wildcards.

Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...