Splunk Search

earliest and latest value from a chart

nSphere
New Member

Hello community,

I am searching since few days a solution to display the earliest and latest value from a chart into a dashboard.

here is my query;

<search>
<query>index=main Name=volume_* | chart sum("Used Capacity TB") AS "Used Capacity TB", sum("Total Capacity TB") AS "Total Capacity TB" by _time span=7d</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>

I would like to extract the earliest and latest value and then substract the latest-earliest divided by the number of days.

 

exemple,

values of 

earliest is 50

latest is 52

the calculation will be 

52-50 = 2

2/7d = 0.286

 

Thank you!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use addinfo - for example

| makeresults 
| addinfo
| fieldformat info_min_time=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") 
| fieldformat info_max_time=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...