Splunk Search

## How to use Splunk for mathematical difference in stats?

Explorer

Hello,
I would like to try using Splunk to calculate the difference in numbers from one sample to the next. Here is some theoretical log entries.

The data indexed will look like this:

``````yesterday_timeStamp clusterId=abc, topicName=mytopic, partition=0, lastOffset=100
yesterday_timeStamp clusterId=abc, topicName=mytopic, partition=1, lastOffset=200
today_timeStamp clusterId=abc, topicName=mytopic, partition=0, lastOffset=355
today_timeStamp clusterId=abc, topicName=mytopic, partition=1, lastOffset=401``````

The number of events in the last 24 hours would be partition 0(355-200=155), partition 1(401-200=201) Sum of partitions for topic(mytopic) = 155+201=356
There will be many topicName(s) and possible different numbers of partition(s) per topicName.
Can I use splunk to calculate the numbers of events per partition and topic  since yesterday?

Labels (1)
• ### stats

Tags (3)
Explorer

Thank you I appreciate the help.  I was too literal.  The timestamp will be a real date/time.  How do I structure this where clause to be the latest?(all events will present the same date/time for each "interval", as described that would be a day)

| where timestamp="today_timeStamp"

Tags (1)
SplunkTrust

I still don't see why ITWhisperer's tstats formula should not work, but simple stats should also be able to do the job assuming the "since yesterday" piece is done with search time filter.

``````| stats max(lastOffset) as maxOffset min(lastOffset) as minOffset by partition topicName clusterId
| eval numEvents=maxOffset - minOffset
| eventstats sum(numEvents) as totalEvents``````

One thing I can't figure out is how to derive number of events in partition 0 as 355-200=155; shouldn't it be 355-100=255? (Lines one and three.)  Is there a relation that I missed?

The above gives

 patition topicName clusterId maxOffset minOffset numEvents totalEvents 0 mytopic abc 355 100 255 456 1 mytopic abc 401 200 201 456
Tags (1)
Explorer

Thank you. You are correct,  355-200 was a mistake.

SplunkTrust
``````| streamstats window=2 global=f range(lastOffset) as difference by clusterId topicName partition
| where timestamp="today_timeStamp"
| stats sum(difference) as events by clusterId topicName``````
Get Updates on the Splunk Community!

#### 3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

#### What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

#### Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...