Splunk Search

How to find the timechart of difference value .

Padma12345
Explorer

I have one field abc which contain values of different parameter and it goes on increasing gradually. I have to add the values present in the field abc at two different intervals and then the difference of that two values. I want the timechart of that difference value.
Following is the example

At 12.00 AM                           At 12.00 PM
def         abc                       def         abc
xxx         11                        xxx         13
xxy         23                        xxy         25
xyy         09                        xyy         11
yyy         45                        yyy         48

What I have to do is add values of field abc which contain x at 12 am & 12 pm and then want to show timechart of the difference. i.e at 12 am: 11+23+09=43 & at 12 pm: 13+25+11=49, then 49-43= 7, then timechart this value.

Any help is appreciated..

Thanks.....!

Padma

Tags (1)
0 Karma

woodcock
Esteemed Legend

I am taking a VERY loose interpretation of the timechart portion of your request (otherwise it doesn't make sense). Like this:

... stats min(_time) AS startTime max(_time) AS endTime sum(xxx) AS xxx sum(xxy) AS xxy | eval diff=abs(xxx-xxy)
0 Karma

sundareshr
Legend

Try this

index=* def="*x*" abc=* | timechart span=15m sum(abc) as total | delta total as delta | fields - total
0 Karma

Padma12345
Explorer

Please find the below raw events

7/4/16
11:30:00.000 AM
"1467612000.000","-","xxx","37211.2265625"
7/4/16
11:30:00.000 AM
"1467612000.000","-","xxy","45632.70703125"

7/4/16
11:15:00.000 AM
"1467611100.000","-","xxx","37208.40234375"
7/4/16
11:15:00.000 AM
"1467611100.000","-","xxy","45629.41015625"

I want to add value of xxx & xxy at 11.15 & 11.30 am and then need to plot the timechart of difference value.

Thanks

Padma

0 Karma

Richfez
SplunkTrust
SplunkTrust

I started thinking streamstats, then foreach, but finally settled on exactly what woodcock said - a few raw events would go very far in helping us understand the question better and without them we're more or less blind.

0 Karma

woodcock
Esteemed Legend

Show me 2 raw events and I will give you an answer. I do not understand the raw event format.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...