subtract previous results with current result

[kpavan]

Hi All,

I have a result which shows the total user directory count for every 1hr, but I want to how many user got created in last hour. Below is the current result which is showing entire user count,

2016-19-09 11:00:03 1920117
2016-19-09 10:00:03 1919999
2016-19-09 09:00:03 1919891
2016-19-09 08:00:03 1919769
2016-19-09 07:00:03 1919657
2016-19-09 06:00:03 1919571

Consider opening value 1919571, after 1hr 86 user account got created then my next hour count is 1919657, but I want to add one more column stating that 86 user created in last 1hr OR is it possible to subtract the previous value with current value. So that i can show management that for each date N number of users created.

Please help me with query which will show me the result of count for each hour

Thanks!

[woodcock]

There are many ways to do this but the most straightforward is to use the delta command:
https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Delta

[inventsekar]

Thanks Woodcock Sir.. on your previous post on this same topic, I learnt the autoregress and now Delta!

[inventsekar · Accepted solution]

tested and working fine..

sourcetype=usercount | rex field=_raw "(?<userCount>\d{7})" | streamstats current=f window=1 global=f last(userCount) as PreviousCount | eval Change=PreviousCount-userCount | table _time userCount Change

autoregress also working fine.. tested and good ...

sourcetype=usercount | rex field=_raw "(?<userCount>\d{7})" | autoregress userCount p=1 | eval UserChange=userCount_p1-userCount | table _time userCount UserChange

[kpavan]

Its working... Thanks much inventsekar!