Splunk Search

earliest and latest value from a chart

nSphere
New Member

Hello community,

I am searching since few days a solution to display the earliest and latest value from a chart into a dashboard.

here is my query;

<search>
<query>index=main Name=volume_* | chart sum("Used Capacity TB") AS "Used Capacity TB", sum("Total Capacity TB") AS "Total Capacity TB" by _time span=7d</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search>

I would like to extract the earliest and latest value and then substract the latest-earliest divided by the number of days.

 

exemple,

values of 

earliest is 50

latest is 52

the calculation will be 

52-50 = 2

2/7d = 0.286

 

Thank you!

 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use addinfo - for example

| makeresults 
| addinfo
| fieldformat info_min_time=strftime(info_min_time,"%Y-%m-%d %H:%M:%S") 
| fieldformat info_max_time=strftime(info_max_time,"%Y-%m-%d %H:%M:%S")
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...