Splunk Search

In timechart query plot the difference of values from two polls each at 30 sec intervals

sawgata12345
Path Finder

Blockquote
I have similar json input as below, every minute similar blocks of data is send to index.

I am plotting timechart using below query, this avg is working fine, its averaging row1 of event1 and row1 of event2, similarly for all:
index="naveentest2" |fields sid,did,lun,readiobyte,readiotime |eval result = readiobyte / readiotime|eval combination=sid."-".did."-".lun | timechart span=30 avg(result) as AVG usenull=f by combination

but here i need a diff between two sets of values means the first line of event 2- first line of event 1,first line of event 3- first line of event 2,first line of event 4- first line of event 3,
similarly for other lines.
and i dont need the avg() function in the timechart below, only the result should get printed

index="naveentest2" |fields sid,did,lun,readiobyte,readiotime |eval result = (readiobyte2-readiobyte1) / (readiotime2-readiotime1)|eval combination=sid."-".did."-".lun | timechart span=30 avg(result) as AVG usenull=f by combination

the time difference between each event is 30sec,event1(bunch of data as below),event2(bunch of data as below) similarly event3, event4...

--event 1 - all records going at once
{"sid": "s1", "did": "d1","lun": "l1","readiobyte":"100","readiotime":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l2","readiobyte":"400","readiotime":"15","iocompletetime":"10","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l3","readiobyte":"50","readiotime":"10","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l4","readiobyte":"100","readiotime":"20","iocompletetime":"20","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l5","readiobyte":"10","readiotime":"5","iocompletetime":"1","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s1", "did": "d1","lun": "l6","readiobyte":"50","readiotime":"2","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l1","readiobyte":"150","readiotime":"30","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l2","readiobyte":"100","readiotime":"15","iocompletetime":"2","Timestamp": "2018-03-24 06:12:53"}
{"sid": "s2", "did": "d1","lun": "l3","readiobyte":"100","readiotime":"20","iocompletetime":"1","Timestamp": "2018-03-24 06:12:53"}

--event 2 all records going at once
{"sid": "s1", "did": "d1","lun": "l1","readiobyte":"120","readiotime":"20","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l2","readiobyte":"500","readiotime":"50","iocompletetime":"5","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l3","readiobyte":"150","readiotime":"10","iocompletetime":"1","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l4","readiobyte":"120","readiotime":"30","iocompletetime":"30","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l5","readiobyte":"15","readiotime":"2","iocompletetime":"1","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s1", "did": "d1","lun": "l6","readiobyte":"70","readiotime":"5","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l1","readiobyte":"180","readiotime":"6","iocompletetime":"4","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l2","readiobyte":"120","readiotime":"12","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}
{"sid": "s2", "did": "d1","lun": "l3","readiobyte":"140","readiotime":"20","iocompletetime":"2","Timestamp": "2018-03-24 06:13:23"}

Can anyone throw some light on this?
Blockquote

0 Karma

paramagurukarth
Builder

Try Span

.... | timechart span=30s ....

Check here and here

0 Karma

sawgata12345
Path Finder

As you can see in the question i have already used timechart span=30 but timechart needs a function mandatorily (avg/min/max etc but diff is not mentioned anywhere in documentatin).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...