Splunk Search

Why are there issues with delta query by multiple hostnames?

Path Finder


index=testlab sourcetype=testcsv

| rex field="status detail" "(?<message_received_name>Messages Received)\\s*[0-9,]*\s*[0-9,]*\s*(?<message_received>[0-9,]*)"
| rex field=message_received mode=sed "s/,//g"
| eval myInt = tonumber(message_received)
| reverse
| delta myInt as message_received_delta
| timechart span=10m sum(message_received_delta) by Hostname


the problem i find is that when i am doing only 1 hostname at a time. it works just fine. (note the data is incremental counters only). but when i introduce additional hostnames, i see some hostnames would show a negative value. it should only show positive numbers (0 to inifinity)

again when i do single host, it works just fine. 🙂 really need help on this one.


Labels (1)
0 Karma



Unfortunately delta works simply on the message stream and does not support any 'by FIELD' construct.

You need to use streamstats for that - note that when splitting by fields in streamstats you need to use the global=f flag.

Take a look at the reply to your other message which shows you the streamstats construct that should work.

Kudos for experimenting! Good to learn.


0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...