Splunk Search

How to get the difference of two different fields?

cdevoe57
Explorer

I have a log file that produces two fields - kernel_packets and kernel_drops. These values are updated every 5 minutes, and accumulate until the app is restarted. That is, each value is larger than the previous. I need to calculate the percent loss over that 5 minute interval. I want to be able to chart these values over time.

To do this

(kernel_drops(at T=0) - kernel_drops (T-5) / kernel_packets (T=0) - kernel_packets(T-5)) *100

I can use the delta function to get on of the values for on or the other but not both

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json" | stats count by _time,stats.capture.kernel_packets |delta  stats.capture.kernel_packets p=1 

How can I get the delta function to work on both parameters?

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json"
| fields _time stats.capture.kernel_packets stats.capture.kernel_drops
| streamstats current=f window=1 values("stats.capture.kernel_packets") as prev_kernel_packets values("stats.capture.kernel_drops") as prev_kernel_drops
| eval percent_loss=round((prev_kernel_drops-'stats.capture.kernel_drops')*100/(prev_kernel_packets-'stats.capture.kernel_packets'),2)
| table _time percent_loss

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json"
| fields _time stats.capture.kernel_packets stats.capture.kernel_drops
| streamstats current=f window=1 values("stats.capture.kernel_packets") as prev_kernel_packets values("stats.capture.kernel_drops") as prev_kernel_drops
| eval percent_loss=round((prev_kernel_drops-'stats.capture.kernel_drops')*100/(prev_kernel_packets-'stats.capture.kernel_packets'),2)
| table _time percent_loss
0 Karma

DalJeanis
Legend

@somesoni2 - round

0 Karma

cdevoe57
Explorer

Thanks!! Works perfectly. And yes, I found the round!!!!

0 Karma

cmerriman
Super Champion

have you tried using the streamstats command?

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json" | stats count by _time,stats.capture.kernel_packets|sort 0 _time|streamstats window=1 current=f values(stats.capture.kernel_packets) as prevPacket values(_time) as prevTime|eval delta1=prevPacket-stats.capture.kernel_packets....

something like that for a starting point?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...