Splunk Search

graphing cumulative counters

charleswheelus
Path Finder

I have several counters reported to splunk which continually increment over time and are rarely if ever reset. I would like to be able to graphs the deltas between each counter over a period of time.

For instance, lets call one of the counters "LOGINS". Over time LOGINS will continue to accumulate every time a user logs in. I would like to be able to display a graph of the number of logins per hour over each day, and NOT each subsequently larger number of logins. Which means that while my data looks like that data in the first graph, what I want to display is the second graph. (See below)

Can someone explain how this can be accomplished?

Cumulative - How my data actually exists in splunk
cumulative

Non Cumulative - what I want to display
non-cumulative

Tags (2)
1 Solution

cphair
Builder

Use the delta command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

It is applied in the order of events (that is, newest to oldest), so you will see negative deltas on an accumulated field, but you should be able to work out the graph you want from that data.

View solution in original post

cphair
Builder

Use the delta command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta

It is applied in the order of events (that is, newest to oldest), so you will see negative deltas on an accumulated field, but you should be able to work out the graph you want from that data.

charleswheelus
Path Finder

The delta command did work. I had to use the reverse command to get the chart ordered the way I wanted it. In the context of this problem the syntax I used was:

LOGINS | reverse | table LOGINS | delta LOGINS AS logindelta

I then selected the chart icon in the results tab.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...