Splunk Search

Why are there issues with delta query by multiple hostnames?

Path Finder


index=testlab sourcetype=testcsv

| rex field="status detail" "(?<message_received_name>Messages Received)\\s*[0-9,]*\s*[0-9,]*\s*(?<message_received>[0-9,]*)"
| rex field=message_received mode=sed "s/,//g"
| eval myInt = tonumber(message_received)
| reverse
| delta myInt as message_received_delta
| timechart span=10m sum(message_received_delta) by Hostname


the problem i find is that when i am doing only 1 hostname at a time. it works just fine. (note the data is incremental counters only). but when i introduce additional hostnames, i see some hostnames would show a negative value. it should only show positive numbers (0 to inifinity)

again when i do single host, it works just fine. 🙂 really need help on this one.


Labels (1)
0 Karma



Unfortunately delta works simply on the message stream and does not support any 'by FIELD' construct.

You need to use streamstats for that - note that when splitting by fields in streamstats you need to use the global=f flag.

Take a look at the reply to your other message which shows you the streamstats construct that should work.

Kudos for experimenting! Good to learn.


0 Karma
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW! Every day the list of sources Admins are responsible for gets bigger and bigger, often making ...