I want to take a totals field. And display the rate on a chart.
For example:
Total = 0, 1, 2, 3, 4, 5, 6, 7, 9, 10
Rate = 0, 1, 1, 1, 1, 1, 1, 1, 2, 1.
__
_____________________/ \__
____/
Take that as a rough guide anyway. I have looked through List(X) to see all my values which works, but I cannot figure out how you subtract the Last(X) value from the 'LastMinusOne(X)' value...
Thanks - and sorry for the crude graph 🙂
I think the delta
command is what you're looking for:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta
... | delta total as rate | eval rate=coalesce(rate,0)
I think the delta
command is what you're looking for:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Delta
... | delta total as rate | eval rate=coalesce(rate,0)
Sorry I'm very new to these operations. How can I use this on a field value eg TotalNumbers=16 and chart it?