Splunk Search

Splunk search

Emily12
Explorer

Hi Everyone,

How can I write splunk search query to check if for particular variable value has increased in 4 hours.

Thanks in advance :smiling_face_with_smiling_eyes:

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Emily12,

your request is just a little vague!

Anyway, try someting like this:

your_search earliest=-4h@h latest=now
| stats min(variable) AS min max(variable) AS max 
| where NOT min=max

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Emily12,

your request is just a little vague!

Anyway, try someting like this:

your_search earliest=-4h@h latest=now
| stats min(variable) AS min max(variable) AS max 
| where NOT min=max

Ciao.

Giuseppe

Emily12
Explorer

@gcusello Thank you so much.

This is what I was looking for.

 

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Emily12,

good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated :winking_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...