Splunk Search

graphing cumulative counters

charleswheelus
Path Finder

I have several counters reported to splunk which continually increment over time and are rarely if ever reset. I would like to be able to graphs the deltas between each counter over a period of time.

For instance, lets call one of the counters "LOGINS". Over time LOGINS will continue to accumulate every time a user logs in. I would like to be able to display a graph of the number of logins per hour over each day, and NOT each subsequently larger number of logins. Which means that while my data looks like that data in the first graph, what I want to display is the second graph. (See below)

Can someone explain how this can be accomplished?

Cumulative - How my data actually exists in splunk
cumulative

Non Cumulative - what I want to display
non-cumulative

Tags (2)
1 Solution

cphair
Builder

Use the delta command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

It is applied in the order of events (that is, newest to oldest), so you will see negative deltas on an accumulated field, but you should be able to work out the graph you want from that data.

View solution in original post

cphair
Builder

Use the delta command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

It is applied in the order of events (that is, newest to oldest), so you will see negative deltas on an accumulated field, but you should be able to work out the graph you want from that data.

charleswheelus
Path Finder

The delta command did work. I had to use the reverse command to get the chart ordered the way I wanted it. In the context of this problem the syntax I used was:

LOGINS | reverse | table LOGINS | delta LOGINS AS logindelta

I then selected the chart icon in the results tab.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...