Splunk Search

How to calculate rate of change over time for an variable

mflamerich
Explorer

I have an input value that changes steadily (at constant rate, either increasing or decreasing), and Splunk is capturing every value with a timestamp.

I am trying to find a way to calculate the acceleration of this input, which is the rate of change over time.
Ideally, I would like to trigger an alert if a threshold in this rate of change is reached.

Any smooth changes in the velocity are fine, but abrupt changes (speed up, slow down larger than some threshold) should trigger an alarm, or at least should be visible in a Splunk graph for analysis against other kind of time based data for event correlation analysis.

Mathematically, the problem should be simple: Acceleration is the second derivative of a function.
However, it is difficult to model a function (much less find the derivatives) from just raw data.

I might be over-thinking this, therefore I'm reaching out to other splunkers for ideas.

Thanks.

Tags (2)

kristian_kolb
Ultra Champion

If you are talking about a steady increase/decrease (not acceleration) delta would be a good option.

If you are talking about acceleration/deceleration hmm .. perhaps would be something that you can work on.

... | streamstats window=X stdev(your_field) as Y

Large values of Y would indicate that there has been a significant change, and that the current value of your_field is different from the previous X number of values.

http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/CommonStatsFunctions
http://docs.splunk.com/Documentation/Splunk/5.0.3/SearchReference/Streamstats

/k

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...