Splunk Search

I am having a hard time getting delta to work. Ideas?

talbot7
Path Finder

When I search for:
index=unix pool=general1 dom0stat42
| delta stolen_cpu_ticks as sct
| eval abssct=abs(sct)
| timechart sum(abssct) span=1m by hardware

I get:

_time a4-hpc1-1 a4-hpc1-2 a4-hpc1-3 a4-hpc1-5 a4-hpc1-6
1 9/30/11 8:34:00.000 AM 1449940 1710969 5285059 5107148 439020
2 9/30/11 8:35:00.000 AM 1449917 1711019 5285126 5107278 439015
3 9/30/11 8:36:00.000 AM 1449885 1711043 5285205 5107419 439037
4 9/30/11 8:37:00.000 AM 1449863 1711078 5285282 5107536 439029

Splunk is showing me the hardware correctly, but not the delta. When I search for a single peace of hardware with the following command, delta works.

index=unix pool=general1 dom0stat42 a4-hpc1-1
| delta stolen_cpu_ticks as sct
| eval abssct=abs(sct)
| timechart sum(abssct) span=1m


_time sum(abssct)
1 9/30/11 8:38:00.000 AM 149
2 9/30/11 8:39:00.000 AM 120
3 9/30/11 8:40:00.000 AM 127
4 9/30/11 8:41:00.000 AM 90

Any ideas/help would be greatly appreciated.

Tags (1)
1 Solution

talbot7
Path Finder

Any ideas out here?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...