Splunk Search

How to find deltas greater than 5 skipping over rows that are different

michaelsplunk1
Path Finder

Hello!

Sample data:

VehicleHour of Daycountdelta(count)
car1115--
car1120-5
car11333
car21196
car2125-4
car31150
car31250
car3130-5
car31422

 

Please notice how delta(count) is calculated even going from a row that says car1 to car2 or car2 to car3. I want to alert when delta(count) is greater than 5, but only if this delta is calculated going from a row that car2 to a similar next row that is also for car2. That is, if the row switches from car1 to car2 and delta is greater than 5, or like in the table, delta is 6, I want to ignore this change and only show rows with deltas greater than 5 that were calculated for the same car, and not between different cars. Is there a way to do this?

I tried to using streamstats/eventstats with the last() function but I'm not sure that I am using it correctly.

For the end product, I need an alert that will fire off when a car has an increase in its count of more than 5.

Thank you so much for any help!!!

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the current query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...