Very frequently, I collect statistics in the form of absolute values like "Total number of requests", "Size of queue" etc. Is there an easy way to show the change rate in a timechart? Let's say we have the following simple timechart that shows the egress of messages per queue per minute: timechart span=1m max(total_egress) by queue Data: 0 - 10 - 20 - 200 How I can convert this to messages sent per minute per queue? Data: 0 - 10 - 10 - 180 I found something like this http://answers.splunk.com/answers/59617/show-proper-rate-of-a-continually-increasing-value but it is way to elaborate for my taste. I would like to able to calculate that rate ad hoc in a search. Or there is http://answers.splunk.com/answers/46472/find-rate-from-total but that doesn't work if I need the rate by queue. ... View more

I created a summary index summary_example. Using the 'collect' command I wrote events into a stash_new file. SomeSearch | sitimechart span=1h max(SomeMetric) by Name | collect index=summary_example I receive a message that the file has been successfully written: Changing file extension to .stash_new for file=$random$_events.stash Successfully wrote file to '106082206_events.stash_new'. However, the search result does not appear in the index. I searched index=_internal "106082206_events.stash_new" but didn't receive any events (other than the events to the search on the internal index itself). How can I trouble shoot? ... View more