Splunk Search

earliest and latest value from a chart

nSphere
New Member

Hello community,

I am searching since few days a solution to display the earliest and latest value from a chart into a dashboard.

here is my query;

<search>
<query>index=main Name=volume_* | chart sum("Used Capacity TB") AS "Used Capacity TB", sum("Total Capacity TB") AS "Total Capacity TB" by _time span=7d</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>

I would like to extract the earliest and latest value and then substract the latest-earliest divided by the number of days.

 

exemple,

values of 

earliest is 50

latest is 52

the calculation will be 

52-50 = 2

2/7d = 0.286

 

Thank you!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use addinfo - for example

| makeresults 
| addinfo
| fieldformat info_min_time=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") 
| fieldformat info_max_time=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...