Reporting

looking for a counter that decreases

tedder
Communicator

I have a field that should be increasing - though not monotonically increasing.

a=1
a=4
a=9
a=13
a=14
a=10
a=101

I want to alert if the number gets smaller. Here's my attempt at this.

index="myindex" | stats max(a) as maxnum | where a < maxnum

That doesn't find it because the number never decreases below 101. However, even if I change the query, it doesn't find any rows!

index="myindex" | stats max(a) as maxnum | where a < (maxnum-100)

Obviously, that doesn't do what I want. But it was an interesting diagnosis. I was inspired by this question, but I can't change it to do what I want. Can/should I do this with a subsearch?

0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this with "delta" search operator.

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Basically, do a search similar to:

index="myindex" | delta a as a_delta | where a_delta < 0

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

You might be able to do this with "delta" search operator.

http://www.splunk.com/base/Documentation/latest/SearchReference/Delta

Basically, do a search similar to:

index="myindex" | delta a as a_delta | where a_delta < 0

tedder
Communicator

delta is precisely what I needed. Streamstats might too, but delta was even easier!

0 Karma

southeringtonp
Motivator

You could do it with streamstats too, but delta is the simplest approach.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...