How to convert a cumulative total into a rate

[adriangrassi]

I have this field which display the total number of transactions since the server has been started. I need to find out our transaction rate and I can't seem to do this in Splunk.
Our stats gets collected every 5 minutes and look something like this:

01:10am Messages=1000
01:15am Messages=1500
01:20am Messages=2000
etc..
That means that between 1:10 and 1:15 the server processed 500 transactions and that's the result I need to get from Splunk so that I can calculate our transactions per second rate.

As far as I can tell Splunk would need to know the previous 5 minute value and compare to the current value of the field.

I tried this but it doesn't work as I get the accumulated total:
| stats sum(eval(Msgs/300)) as Trans by host

Thanks for any help.

[adriangrassi · Accepted solution]

I was able to finally get this working using the following query:

search | bucket _time span=5m | stats sum(eval(Msgs)) as 5MinCount by host _time | delta 5MinCount | sort _time | stats latest by host | rename latest(delta(5MinCount)) as delta | stats sum(eval(delta/300)) as Transactions_per_sec by host

This query above takes 2 samples of a cumulative total and finds the difference between them and then calculates the rate while ignoring the 1st set of delta data which is invalid since it has nothing to compare against.

Hopefully this helps someone else in the same situation.
For the record I still think that converting a cumulative total into a transaction rate should have been its own function in Splunk.

Thanks,
-Adrian

[kristian_kolb]

...| table _time Messages | delta Messages as Current | eval TransRate = Curr / 300

/k