Splunk Search

How to use Splunk for mathematical difference in stats?

chengka
Explorer

Hello,
I would like to try using Splunk to calculate the difference in numbers from one sample to the next. Here is some theoretical log entries.

The data indexed will look like this:

yesterday_timeStamp clusterId=abc, topicName=mytopic, partition=0, lastOffset=100
yesterday_timeStamp clusterId=abc, topicName=mytopic, partition=1, lastOffset=200
today_timeStamp clusterId=abc, topicName=mytopic, partition=0, lastOffset=355
today_timeStamp clusterId=abc, topicName=mytopic, partition=1, lastOffset=401

The number of events in the last 24 hours would be partition 0(355-200=155), partition 1(401-200=201) Sum of partitions for topic(mytopic) = 155+201=356
There will be many topicName(s) and possible different numbers of partition(s) per topicName.
Can I use splunk to calculate the numbers of events per partition and topic  since yesterday?

Labels (1)
0 Karma

chengka
Explorer

Thank you I appreciate the help.  I was too literal.  The timestamp will be a real date/time.  How do I structure this where clause to be the latest?(all events will present the same date/time for each "interval", as described that would be a day)

| where timestamp="today_timeStamp"

Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

I still don't see why ITWhisperer's tstats formula should not work, but simple stats should also be able to do the job assuming the "since yesterday" piece is done with search time filter.

 

| stats max(lastOffset) as maxOffset min(lastOffset) as minOffset by partition topicName clusterId
| eval numEvents=maxOffset - minOffset
| eventstats sum(numEvents) as totalEvents

 

One thing I can't figure out is how to derive number of events in partition 0 as 355-200=155; shouldn't it be 355-100=255? (Lines one and three.)  Is there a relation that I missed?

The above gives

patitiontopicNameclusterIdmaxOffsetminOffsetnumEventstotalEvents
0mytopicabc355100255456
1mytopicabc401200201456
Tags (1)

chengka
Explorer

Thank you. You are correct,  355-200 was a mistake. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats window=2 global=f range(lastOffset) as difference by clusterId topicName partition
| where timestamp="today_timeStamp"
| stats sum(difference) as events by clusterId topicName
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...