Splunk Search

How to modify delta search to convert negative values in results to positive values?

nramya82
Explorer

Hi ,

I need to make a graph for the delta_f where i am finding the difference of current value and next value . By using the query below I get some negative values. Can any one help me find what needs to be added in my search to convert all the negative values into positive values?

|search abc| eval delta_f= nextValues - currentValues | timechart span=1d sum(delta_f)

eg: say for delta_f = (nextvalue) - (currentvalue)

0000986 - 5362722 = -5361736 Instead i want only 5361736

Tags (1)
1 Solution

adauria_splunk
Splunk Employee
Splunk Employee

Pipe results to an eval statement like

eval delta_f = abs(delta_f)

Which converts to absolute value

View solution in original post

adauria_splunk
Splunk Employee
Splunk Employee

Pipe results to an eval statement like

eval delta_f = abs(delta_f)

Which converts to absolute value

nramya82
Explorer

Yep that worked . Thanks a lot !

0 Karma

ppablo
Retired

Hi @nramya82

Glad @adauria_splunk helped you find your solution :slightly_smiling_face: You used eval to find the difference between your field values, but there actually is a delta command for this purpose, just so you know for future reference. Check out the documentation for it here:
http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Delta

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...