Splunk Search

How to get the difference of two different fields?

cdevoe57
Explorer

I have a log file that produces two fields - kernel_packets and kernel_drops. These values are updated every 5 minutes, and accumulate until the app is restarted. That is, each value is larger than the previous. I need to calculate the percent loss over that 5 minute interval. I want to be able to chart these values over time.

To do this

(kernel_drops(at T=0) - kernel_drops (T-5) / kernel_packets (T=0) - kernel_packets(T-5)) *100

I can use the delta function to get on of the values for on or the other but not both

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json" | stats count by _time,stats.capture.kernel_packets |delta  stats.capture.kernel_packets p=1 

How can I get the delta function to work on both parameters?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json"
| fields _time stats.capture.kernel_packets stats.capture.kernel_drops
| streamstats current=f window=1 values("stats.capture.kernel_packets") as prev_kernel_packets values("stats.capture.kernel_drops") as prev_kernel_drops
| eval percent_loss=round((prev_kernel_drops-'stats.capture.kernel_drops')*100/(prev_kernel_packets-'stats.capture.kernel_packets'),2)
| table _time percent_loss

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json"
| fields _time stats.capture.kernel_packets stats.capture.kernel_drops
| streamstats current=f window=1 values("stats.capture.kernel_packets") as prev_kernel_packets values("stats.capture.kernel_drops") as prev_kernel_drops
| eval percent_loss=round((prev_kernel_drops-'stats.capture.kernel_drops')*100/(prev_kernel_packets-'stats.capture.kernel_packets'),2)
| table _time percent_loss
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@somesoni2 - round

0 Karma

cdevoe57
Explorer

Thanks!! Works perfectly. And yes, I found the round!!!!

0 Karma

cmerriman
Super Champion

have you tried using the streamstats command?

index=data host="server_name"  source="/usr/local/var/log/suricata/stats.json" | stats count by _time,stats.capture.kernel_packets|sort 0 _time|streamstats window=1 current=f values(stats.capture.kernel_packets) as prevPacket values(_time) as prevTime|eval delta1=prevPacket-stats.capture.kernel_packets....

something like that for a starting point?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...