Splunk Search

earliest and latest value from a chart

nSphere
New Member

Hello community,

I am searching since few days a solution to display the earliest and latest value from a chart into a dashboard.

here is my query;

<search>
<query>index=main Name=volume_* | chart sum("Used Capacity TB") AS "Used Capacity TB", sum("Total Capacity TB") AS "Total Capacity TB" by _time span=7d</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>

I would like to extract the earliest and latest value and then substract the latest-earliest divided by the number of days.

 

exemple,

values of 

earliest is 50

latest is 52

the calculation will be 

52-50 = 2

2/7d = 0.286

 

Thank you!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use addinfo - for example

| makeresults 
| addinfo
| fieldformat info_min_time=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") 
| fieldformat info_max_time=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...