Splunk Search

delta for multiple fields not calculating correctly

aaronkorn
Splunk Employee
Splunk Employee

Hello,

We have a search that is looking through a script that calculates the size of directories throughout the day and we would like to see the delta change over time per directory. Here is what we have so far:

index=sccm sourcetype=sccm source="E:\SCCM2012-folderdata\SCCM-Folder-Status-Counter-S02-v10.CSV" Size>5 AND Directory!=*pkginfo.box| delta Size AS Size | timechart span=30m avg(Size) by Directory useother="f"

The delta only works when I specify just one directory and will not calculate is for every directory individually. Any ideas what Im doing wrong in the search or evaluation? Or is there an easier way to do this?

Thanks!

Tags (3)
1 Solution

bmacias84
Champion

Hello,

Check out my post cumulative-counters-by-host. This is a ver similar problem I faced with cumulative counters.

I would recommend doing a something like this:


index=sccm sourcetype=sccm source="E:\SCCM2012-folderdata\SCCM-Folder-Status-Counter-S02-v10.CSV" Size>5 AND Directory!=*pkginfo.box| sort Directory, _time | autoregress Directory as preDirectory | delta Size as Size | eval Size=if(Directory == preDirectory, Size, null())| timechart span=30m avg(Size) by Directory useother="f"

Break down:

This section groups Directories together by name then sorts by _time.


...| sort Directory, _time

Next I use autoregress to grab the previous Directory name which will be used in an eval later.

... | sort Directory, _time | autoregress Directory as preDirectory

Now I use delta to calulate the diferance from the pervious grouped and sorted events.

... | sort Directory, _time |autoregress Directory as preDirectory |delta Size as Size

Using the autoregressed value of preDirectory an if eval statement is used to ensure the delta was calulated for the same Directory and if not replace with null value.

... | sort Directory, _time |autoregress Directory as preDirectory | delta Size as Size | eval Size=if(Directory == preDirectory, Size, null())

Finally you can chart your values by directory. Though I writing this off the cuff so it may take a tweek or two. Hope this helps. Don't forget to accept and/or vote up anwsers.

View solution in original post

bmacias84
Champion

Hello,

Check out my post cumulative-counters-by-host. This is a ver similar problem I faced with cumulative counters.

I would recommend doing a something like this:


index=sccm sourcetype=sccm source="E:\SCCM2012-folderdata\SCCM-Folder-Status-Counter-S02-v10.CSV" Size>5 AND Directory!=*pkginfo.box| sort Directory, _time | autoregress Directory as preDirectory | delta Size as Size | eval Size=if(Directory == preDirectory, Size, null())| timechart span=30m avg(Size) by Directory useother="f"

Break down:

This section groups Directories together by name then sorts by _time.


...| sort Directory, _time

Next I use autoregress to grab the previous Directory name which will be used in an eval later.

... | sort Directory, _time | autoregress Directory as preDirectory

Now I use delta to calulate the diferance from the pervious grouped and sorted events.

... | sort Directory, _time |autoregress Directory as preDirectory |delta Size as Size

Using the autoregressed value of preDirectory an if eval statement is used to ensure the delta was calulated for the same Directory and if not replace with null value.

... | sort Directory, _time |autoregress Directory as preDirectory | delta Size as Size | eval Size=if(Directory == preDirectory, Size, null())

Finally you can chart your values by directory. Though I writing this off the cuff so it may take a tweek or two. Hope this helps. Don't forget to accept and/or vote up anwsers.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...