Hello Splunkers!
I have the following fields being populated by 1000s of values every 1 minute:
Name Cost
E.g.
Luke 1.25
Luke 1.22
Dave 2.45
Dave 2.57
Bearing in mind, there are over 1000 Cost values coming in for each Name each minute, I want to identify the biggest movers in terms of Cost over a 5 minute period thereby identifying the most volatile Names in a timechart.
Can anyone tell me how I would do this please?
Like this:
... earliest=-5m latest=now | stats range(Cost) AS volatility BY Name
| sort 0 - volatility
Also maybe this:
... earliest=-24h latest=now | streamstats time_window=5m range(Cost) AS volatility BY Name
| sort 0 - volatility
1000s of values?
I don't understand 1.25 is 1000s of values.