Splunk Search

How to use delta command to calculate change of current value from previous value to not produce negative results?

neiljpeterson
Communicator

When use the delta command I get results like this

Value  delta(Value)   what-I-want-it-to-be
 1        0                   /
 1        -1                  0
 2        -3                  1
 5        -4                  3
 9        /                   4

Here, delta(n) is value(n)-value(n+1).. that is to say it is calculating the difference of the next value, not the previous.

I want it to be delta(n) = value(n)-value(n-1).

This is normally what I think of when someone says "delta"... the change since the last value, not the change that is about to happen.

Am I using delta wrong? Is there away to use it to calculate past change, not future change?


Returns negative values looking ahead, sorted oldest to newest

eventype=myevents | delta Value | sort + _time 

Returns positive values looking back

eventype=myevents | sort + _time | delta Value
Tags (1)
1 Solution

davebrooking
Contributor

I don't have an instance of Splunk to test on at the moment, but can you sort the data so its order is reversed prior to the delta command?

View solution in original post

ppablo
Retired

Hi @neiljpeterson

Both previous comments on this question are now answers so you can accept whichever one helped solve your issue 🙂 Glad you found what you needed on Splunk Answers!

Patrick

0 Karma

davebrooking
Contributor

I don't have an instance of Splunk to test on at the moment, but can you sort the data so its order is reversed prior to the delta command?

neiljpeterson
Communicator

:facepalm: Duh! Brain is not working today. That does the trick. Please post this as an answer so I can accept it! Thanks!

0 Karma

ppablo
Retired

Hi @neiljpeterson

Would you be able to paste the search query you're using? It'll help folks with giving you an exact answer and also help people with the same problem. A similar question was asked before. Check this out to see if the solution can solve your problem as well. http://answers.splunk.com/answers/152960/how-to-edit-search-so-delta-command-does-not-return-negativ...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...