Splunk Search

Streamstats delta between values on grouped data incorrect

peiffer
Explorer

I have data that is extracted from log events by multiple neighbor pairs. I would like to extract deltas on an integer field tableversion, but only among the same neighbor pair Streamstats was suggested for deltas with a ‘by’ clause. In my example below, the first line delta is empty as expected, and the 2nd line delta is correct. All deltas in later lines are incorrect. How do I make streamstats only look at the previous entry?

index=network_internal source="bgp.log" "BGP Queue" 
| eval neighborpair=host + ":" + neighbor
| sort neighborpair,timestamp
| streamstats window=2 global=f current=f first(tableversion) as tableversion_prev by neighborpair
| eval delta=tableversion-tableversion_prev
| table timestamp neighborpair neighborstate nsrstate tableversion delta inq outq prefixes

alt text

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Either set current=t or window=1.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Either set current=t or window=1.

0 Karma

peiffer
Explorer

Setting window=1 didn't work for me, but current=t did.

Thanks much

0 Karma
Get Updates on the Splunk Community!

About the drill down time range

I want to create a drilldown that searches for the timezone displayed by the Timechart command.<BR />How ...

About Time picker tokens

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on ...

tag as datamodel attribute

I'm confused a bit. I use CIM datamodels.The "tag" field is both a filter for choosing events applicable to a ...