Splunk Search

How to calculate daily values from sum values

ManfredGrill
Explorer

Hi,

I have values that are a total sum of all data processed. I need to calculate the daily values from the daily sums.

Running the following search:

source=... | timechart span=1d eval(round(latest(USED_SPACE)/1024/1024)) as SpaceTB by Media

produces results like:

                    A       B       C       D
2015-11-06      70.85   298.18  8.76    2.44
2015-11-07      71.28   298.78  8.78    2.44
2015-11-08      71.34   299.38  8.78    2.44
2015-11-09      71.36   299.43  8.78    2.50
..

I need a table that calculates the amount of data that was processed each day. That means to subtract the current value from the value of the previous day for each day (or other SPAN interval).

Results should look like

                    A       B       C       D
2015-11-06          
2015-11-07      0.43        0.6 0.02    0
2015-11-08      0.06        0.6 0       0
2015-11-09      0.02        0.05    0       0.06
..

Any suggestions?
Thank you

0 Karma

HeinzWaescher
Motivator

Try to add:

 ....
| delta A as A
| delta B AS B
| delta C AS C
| delta D AS D

To compare another span you can add the parameter p=n
See the docs here: http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Delta

0 Karma

ManfredGrill
Explorer

Hi Heinz,

This works just great.
Automatic creation of the new columns would be nice, but I can easily use this solution.

Thank you.
Manfred

0 Karma

HeinzWaescher
Motivator

When the numbers are always growing over time, this could be an option as well to have automatic column creation

x is the wildcard here, i don't know why the star is ignored in the comments....

....
| streamstats range(x) window=2
| fields+ _time, rangex

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...