Splunk Search

In timechart query plot the difference of values from two polls each at 30 sec intervals

sawgata12345
Path Finder

Blockquote
I have similar json input as below, every minute similar blocks of data is send to index.

I am plotting timechart using below query, this avg is working fine, its averaging row1 of event1 and row1 of event2, similarly for all:
index="naveentest2" |fields sid,did,lun,readiobyte,readiotime |eval result = readiobyte / readiotime|eval combination=sid."-".did."-".lun | timechart span=30 avg(result) as AVG usenull=f by combination

but here i need a diff between two sets of values means the first line of event 2- first line of event 1,first line of event 3- first line of event 2,first line of event 4- first line of event 3,
similarly for other lines.
and i dont need the avg() function in the timechart below, only the result should get printed

index="naveentest2" |fields sid,did,lun,readiobyte,readiotime |eval result = (readiobyte2-readiobyte1) / (readiotime2-readiotime1)|eval combination=sid."-".did."-".lun | timechart span=30 avg(result) as AVG usenull=f by combination

the time difference between each event is 30sec,event1(bunch of data as below),event2(bunch of data as below) similarly event3, event4...

--event 1 - all records going at once
{"sid": "s1", "did": "d1","lun": "l1","readiobyte":"100","readiotime":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l2","readiobyte":"400","readiotime":"15","iocompletetime":"10","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l3","readiobyte":"50","readiotime":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l4","readiobyte":"100","readiotime":"20","iocompletetime":"20","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l5","readiobyte":"10","readiotime":"5","iocompletetime":"1","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l6","readiobyte":"50","readiotime":"2","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l1","readiobyte":"150","readiotime":"30","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l2","readiobyte":"100","readiotime":"15","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l3","readiobyte":"100","readiotime":"20","iocompletetime":"1","Timestamp": "2018-03-24 06:12:53"}

--event 2 all records going at once
{"sid": "s1", "did": "d1","lun": "l1","readiobyte":"120","readiotime":"20","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l2","readiobyte":"500","readiotime":"50","iocompletetime":"5","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l3","readiobyte":"150","readiotime":"10","iocompletetime":"1","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l4","readiobyte":"120","readiotime":"30","iocompletetime":"30","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l5","readiobyte":"15","readiotime":"2","iocompletetime":"1","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l6","readiobyte":"70","readiotime":"5","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l1","readiobyte":"180","readiotime":"6","iocompletetime":"4","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l2","readiobyte":"120","readiotime":"12","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l3","readiobyte":"140","readiotime":"20","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}

Can anyone throw some light on this?
Blockquote

0 Karma

paramagurukarth
Builder

Try Span

.... | timechart span=30s ....

Check here and here

0 Karma

sawgata12345
Path Finder

As you can see in the question i have already used timechart span=30 but timechart needs a function mandatorily (avg/min/max etc but diff is not mentioned anywhere in documentatin).

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...