Splunk search

[Emily12]

Hi Everyone,

How can I write splunk search query to check if for particular variable value has increased in 4 hours.

Thanks in advance 😊

[gcusello · Accepted solution]

Hi @Emily12,

your request is just a little vague!

Anyway, try someting like this:

your_search earliest=-4h@h latest=now
| stats min(variable) AS min max(variable) AS max 
| where NOT min=max

Ciao.

Giuseppe

[Emily12]

@gcusello Thank you so much.

This is what I was looking for.

[gcusello]

Hi @Emily12,

good for you.

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated 😉