Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About splunk_rookie
splunk_rookie
Engager
Member since:
03-22-2021
03-31-2021
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 03-22-2021 |
Activity Feed
- Posted Re: Identify which power meter reading has stopped increasing for 5 days on Splunk Search. 03-31-2021 08:27 AM
- Posted Identify which power meter reading has stopped increasing for 5 days on Splunk Search. 03-30-2021 02:23 AM
- Posted Re: To generate two sets of values from one field on Splunk Search. 03-23-2021 01:37 AM
- Posted Re: To generate two sets of values from one field on Splunk Search. 03-22-2021 11:14 PM
- Posted To generate two sets of values from one field on Splunk Search. 03-22-2021 07:43 PM
Topics I've Started
03-31-2021
08:27 AM
I get the same result as using latest () Anyway, I came up with another solution. First I sorted by ASSET_NAME and _time, then I used delta to find the power difference between each consecutive events. Next i used delta again to find the duration between the two events. Lastly I searched for power difference = 0 and duration > 432000 sec (5days).
... View more
03-30-2021
02:23 AM
Hi, I am trying to identify which power meter reading has stopped increasing for 5 days. As these power values are accumulated, I assumed that they are always in sequential order with respect to time. Therefore, I sorted the data by ASSET_NAME and _time to get the latest value. Then I took the difference between the latest value for every 5 days. So if the difference is 0, it means that there is no power increment. Do you think that this logic flow is correct? Below is my code: | bucket _time span=5d | sort 0 ASSET_NAME _time | stats latest(VALUE) as latestValue by ASSET_NAME _time | delta latestValue as difference | search difference = 0 Also, let's say the power values are not in sequential order due to some issue, how can I accurately identify the power meter that has stopped increasing? Please help. Thank you! 🙂
... View more
Labels
- Labels:
-
stats
03-23-2021
01:37 AM
thanks! it works~
... View more
03-22-2021
11:14 PM
Hi @scelikok , Assets A and B are from the same field. Sorry, I can't provide the sample data but let me list out the fields which I used. 1. Asset 2. Power 3. _time Given that the power value generated by Asset A is a regenerative energy and Asset B is consumption energy, I had to split the latest(power) and earliest(power) by Asset A and Asset B before subtracting them to obtain the net power consumption.
... View more
03-22-2021
07:43 PM
Hi all, I am new to Splunk and I would like to seek help from the Splunk Community to generate the net power consumption with the following conditions: 1. I have two sets of assets namely A and B, which generate a power consumption value. To get the net power consumption (NPC), I will need to subtract the power value of A from B. (NPC=powerB-powerA) 2. The power consumption values are accumulated. To obtain the power consumed by each asset, I subtracted the earliest power value from the latest value. (power=latest-earliest) The problem which I'm facing now is I can't use the same field (power) to generate the power consumption values for asset A and B. I attempted to do a multisearch because I want both my search to run at the same time but the error which I got was "subsearch contains a non-streaming command". Below is my search query: | multisearch [ | stats latest(Power) as latest_A earliest(Power) as earliest_A by A] [| stats latest(Power) as latest_B earliest(Power) as earliest_B by B] | eval powerA = latestA - earliestA | eval powerB = latestB - earliestB | eval NPC = powerB - powerA What are the alternatives way or commands which will make my query work? Please help!
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-31-2021
11:49 AM
|
