Splunk Search

How to display rate from field value

matthewcanty
Communicator

Very new to this pipeline way of thinking, so apologies if this is trivial...

I am logging every 10 seconds the total number of X which have been cached. So this is incremental: 1, 2, 5, 8, 9, 15 etc. So each log message contains the following TotalCached=x where x is the number cached.

Now I want to chart the rate at which they are being cached. For the range of numbers above, I would like to see the values 0, 1, 3, 3, 1, 6 on a timechart.

I have been told to look at delta and streamstats to no avail.

EDIT

This is close to what I want:

source="..." FeedSource="PinnacleApi" SportId="Football" | delta TotalFixtures p=1 as fixDelta | timechart sum(fixDelta)

However I'd like to take off the FeedSource and SportId, and have the timechart display results by FeedSource or SportId. When I do do this it makes some strange results!

0 Karma
1 Solution

matthewcanty
Communicator

Changed the way we are logging. Logged the rate instead of the total, then did per_second(X)

View solution in original post

0 Karma

matthewcanty
Communicator

Changed the way we are logging. Logged the rate instead of the total, then did per_second(X)

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...