Splunk Search

I am having a hard time getting delta to work. Ideas?

talbot7
Path Finder

When I search for:
index=unix pool=general1 dom0stat42
| delta stolen_cpu_ticks as sct
| eval abssct=abs(sct)
| timechart sum(abssct) span=1m by hardware

I get:

_time a4-hpc1-1 a4-hpc1-2 a4-hpc1-3 a4-hpc1-5 a4-hpc1-6
1 9/30/11 8:34:00.000 AM 1449940 1710969 5285059 5107148 439020
2 9/30/11 8:35:00.000 AM 1449917 1711019 5285126 5107278 439015
3 9/30/11 8:36:00.000 AM 1449885 1711043 5285205 5107419 439037
4 9/30/11 8:37:00.000 AM 1449863 1711078 5285282 5107536 439029

Splunk is showing me the hardware correctly, but not the delta. When I search for a single peace of hardware with the following command, delta works.

index=unix pool=general1 dom0stat42 a4-hpc1-1
| delta stolen_cpu_ticks as sct
| eval abssct=abs(sct)
| timechart sum(abssct) span=1m


_time sum(abssct)
1 9/30/11 8:38:00.000 AM 149
2 9/30/11 8:39:00.000 AM 120
3 9/30/11 8:40:00.000 AM 127
4 9/30/11 8:41:00.000 AM 90

Any ideas/help would be greatly appreciated.

Tags (1)
1 Solution

talbot7
Path Finder

Any ideas out here?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...