Splunk Search
Highlighted

Search to identify the most volatile values in a field

Engager

Hello Splunkers!

I have the following fields being populated by 1000s of values every 1 minute:

Name Cost

E.g.
Luke 1.25
Luke 1.22
Dave 2.45
Dave 2.57

Bearing in mind, there are over 1000 Cost values coming in for each Name each minute, I want to identify the biggest movers in terms of Cost over a 5 minute period thereby identifying the most volatile Names in a timechart.

Can anyone tell me how I would do this please?

0 Karma
Highlighted

Re: Search to identify the most volatile values in a field

Ultra Champion

1000s of values?
I don't understand 1.25 is 1000s of values.

0 Karma
Highlighted

Re: Search to identify the most volatile values in a field

Esteemed Legend

Like this:

... earliest=-5m latest=now | stats range(Cost) AS volatility BY Name
| sort 0 - volatility

Also maybe this:

... earliest=-24h latest=now | streamstats time_window=5m range(Cost) AS volatility BY Name
| sort 0 - volatility
0 Karma