Splunk Search

How to find deltas greater than 5 skipping over rows that are different

michaelsplunk1
Path Finder

Hello!

Sample data:

VehicleHour of Daycountdelta(count)
car1115--
car1120-5
car11333
car21196
car2125-4
car31150
car31250
car3130-5
car31422

 

Please notice how delta(count) is calculated even going from a row that says car1 to car2 or car2 to car3. I want to alert when delta(count) is greater than 5, but only if this delta is calculated going from a row that car2 to a similar next row that is also for car2. That is, if the row switches from car1 to car2 and delta is greater than 5, or like in the table, delta is 6, I want to ignore this change and only show rows with deltas greater than 5 that were calculated for the same car, and not between different cars. Is there a way to do this?

I tried to using streamstats/eventstats with the last() function but I'm not sure that I am using it correctly.

For the end product, I need an alert that will fire off when a car has an increase in its count of more than 5.

Thank you so much for any help!!!

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the current query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...