delta for multiple fields not calculating correctly

[aaronkorn]

Hello,

We have a search that is looking through a script that calculates the size of directories throughout the day and we would like to see the delta change over time per directory. Here is what we have so far:

index=sccm sourcetype=sccm source="E:\SCCM2012-folderdata\SCCM-Folder-Status-Counter-S02-v10.CSV" Size>5 AND Directory!=*pkginfo.box| delta Size AS Size | timechart span=30m avg(Size) by Directory useother="f"

The delta only works when I specify just one directory and will not calculate is for every directory individually. Any ideas what Im doing wrong in the search or evaluation? Or is there an easier way to do this?

Thanks!

[bmacias84 · Accepted solution]

Hello,

Check out my post cumulative-counters-by-host. This is a ver similar problem I faced with cumulative counters.

I would recommend doing a something like this:

index=sccm  sourcetype=sccm source="E:\SCCM2012-folderdata\SCCM-Folder-Status-Counter-S02-v10.CSV" Size>5 AND Directory!=*pkginfo.box| sort Directory, _time | autoregress Directory as preDirectory | delta Size as Size | eval Size=if(Directory == preDirectory, Size, null())| timechart span=30m avg(Size) by Directory useother="f"

Break down:

This section groups Directories together by name then sorts by _time.

...| sort Directory, _time 

Next I use autoregress to grab the previous Directory name which will be used in an eval later.

... | sort Directory, _time | autoregress Directory as preDirectory 

Now I use delta to calulate the diferance from the pervious grouped and sorted events.

... | sort Directory, _time |autoregress Directory as preDirectory |delta Size as Size

Using the autoregressed value of preDirectory an if eval statement is used to ensure the delta was calulated for the same Directory and if not replace with null value.

... | sort Directory, _time |autoregress Directory as preDirectory | delta Size as Size | eval Size=if(Directory == preDirectory, Size, null())

Finally you can chart your values by directory. Though I writing this off the cuff so it may take a tweek or two. Hope this helps. Don't forget to accept and/or vote up anwsers.