How to subtract values from same field in subsequent event and with the resulted values i want to make a chart

[harishbabu]

Hi All,

I am new to Splunk. please help me here on this requirement.

i would like to check if there is any possibility to subtract the values from a same field in subsequent event.

For Example i have below two events in two different time stamps.

9/24/19
6:52:22.000 PM

[Tue Sep 24 16:52:22 GMT 2019] [UM Server Status Generator] [com.pcbsys.foundation] - ServerStatusLog> Memory=1401, Direct=4096, EventMemory=0, Disk=224766, CPU=10.75, Scheduled=468, Queued=0, Connections=3, BytesIn=626255, BytesOut=113227133, Published=1677085616, Consumed=1677214707, QueueSize=0, ClientsSize=0, CommQueueSize=0

9/24/19
6:52:17.000 PM

[Tue Sep 24 16:52:17 GMT 2019] [UM Server Status Generator] [com.pcbsys.foundation] - ServerStatusLog> Memory=1607, Direct=4096, EventMemory=0, Disk=224811, CPU=4.62, Scheduled=468, Queued=0, Connections=3, BytesIn=626255, BytesOut=113207677, Published=1677078549, Consumed=1677207640, QueueSize=0, ClientsSize=0, CommQueueSize=0

Now the result should be on this Field(Published) 1677085616 - 1677078549= result.

........

In the same way ,if i have next event in another time stamp, in fact every 5 seconds i have another event .

9/24/19
6:52:12.000 PM

[Tue Sep 24 16:52:12 GMT 2019] [UM Server Status Generator] [com.pcbsys.foundation] - ServerStatusLog> Memory=1710, Direct=4096, EventMemory=0, Disk=224404, CPU=6.25, Scheduled=467, Queued=0, Connections=3, BytesIn=626255, BytesOut=113183513, Published=1677076834, Consumed=1677205925, QueueSize=1, ClientsSize=0, CommQueueSize=0

Now it would be like previous event field(Published) value - this event field(published) value, so it would be 1677078549 -1677076834= result.

at the end with the resulted values i want to make a graph on the respective times.

Thanks & Regards,
Harish

[richgalloway]

Does ... | streamstats window=2 range(Published) as result do what you need?