Splunk Search

Modify values for timechat based on aggregation function

Oldreader
New Member

There is metric which accumulative counter of some event. Timechart of this metrics look like monotonic function. I cant change metrics therefor i need to calculate derivative function - increase/decrease of counter per period of time. Example query:

index=some_index host="*" |  timechart span=15s max("some_metric") by host | addtotals fieldname=cur | appendcols [search index=some_index host="*" | eval _time=_time+15 | timechart span=15s max("some_metric") by host | addtotals fieldname=prev ] | eval diff=cur-prev | timechart span=1m  max(diff) as "Aggregation"

index=some_index host="*" | timechart span=15s max("some_metric") by host | addtotals fieldname=cur - calculates total of all hosts
appendcols [search index=some_index host="*" | eval _time=_time+15 | timechart span=15s max("some_metric") by host | addtotals fieldname=prev ]- calculates total of all hosts with timeshift
Now I want to calculate subtraction. All goes fine with total, but how to calculate subtraction to each host?

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=some_index host="*" | timechart span=15s max("some_metric") as metric
| delta metric as diff
| timechart span=1m max(diff) as Aggregation
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...