Splunk Search

How to handle streamstats / delta assigning a 'zero' to the first row?

AlexBryant
Path Finder

My query is returning the total number of bytes received by various IP addresses at different points in epoch time. I'm using a combination of sort, streamstats, and delta to show how many ADDITIONAL bytes have been received since the last record, for a given IP address. So the data for a given IP address would be:

epoch_time; IP_address; delta_bytes_received
1000; 192.168.100.1; 0
1005; 192.168.100.1; 600
1008; 192.168.100.1; 70
1018; 192.168.100.1; 0
1021; 192.168.100.1; 223

The problem is that for each IP address's group of records, the delta for the first record shows up as zero since there is no previous record to 'delta' against. So when I run avg() and stdev() on the deltas (which is the end goal), there's always an unnecessary zero in the mix that skews the statistics. I tried assigning all zero-value deltas to 'null', but not only does that remove some valid 'zero' entries (like row number 4 above), the statistics are still generated based on the number of rows received, whether null or not, again skewing the results.

Is there a way for me to remove the first record for each IP address?

Tags (3)
0 Karma
1 Solution

jplumsdaine22
Influencer

Do something like | streamstats count as remove_me by ip | where NOT remove_me=1 before doing you calculations - that will remove the first instance of each ip

View solution in original post

jplumsdaine22
Influencer

Do something like | streamstats count as remove_me by ip | where NOT remove_me=1 before doing you calculations - that will remove the first instance of each ip

View solution in original post

AlexBryant
Path Finder

Simple and works perfectly - thanks!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.