Splunk Search

How to find deltas greater than 5 skipping over rows that are different

michaelsplunk1
Path Finder

Hello!

Sample data:

VehicleHour of Daycountdelta(count)
car1115--
car1120-5
car11333
car21196
car2125-4
car31150
car31250
car3130-5
car31422

 

Please notice how delta(count) is calculated even going from a row that says car1 to car2 or car2 to car3. I want to alert when delta(count) is greater than 5, but only if this delta is calculated going from a row that car2 to a similar next row that is also for car2. That is, if the row switches from car1 to car2 and delta is greater than 5, or like in the table, delta is 6, I want to ignore this change and only show rows with deltas greater than 5 that were calculated for the same car, and not between different cars. Is there a way to do this?

I tried to using streamstats/eventstats with the last() function but I'm not sure that I am using it correctly.

For the end product, I need an alert that will fire off when a car has an increase in its count of more than 5.

Thank you so much for any help!!!

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the current query.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!