I am new two splunk. I am wondering is there a way to calculate the delta of RXdropped from 5 minutes apart.
10:50:00 RXdropped 123
10:55:00 RXdropped 456
asked 09 Nov '11, 10:02
I did this it seems to work for now.
index=os sourcetype="interfaces" host="prdcg4mdbl03.oss.prd" | multikv | eval PercError_PacketLoss=round(((Error * 100)/(RXbytes+TXbytes)),1) | eval StatusError = if(PercError_PacketLoss >= 1.0, "WARNING", "OK") | eval PercRX_PacketLoss=round(((RXdropped * 100)/RXbytes),1) | eval PercTX_PacketLoss=round(((TXdropped * 100)/TXbytes),1) | eval StatusRX = if(PercRX_PacketLoss >= 1.0, "WARNING", "OK") | eval StatusTX = if(PercTX_PacketLoss >= 1.0, "WARNING", "OK") | table time Name StatusError PercError_PacketLoss StatusRX PercRX_PacketLoss StatusTX PercTX_PacketLoss
answered 09 Nov '11, 13:30
Hello! Welcome to Splunk!
If you download the *NIX App, you'll find there is a dashboard for network traffic. Here's the link: Splunk for Unix and Linux on Splunkbase
This is the search that the *nix app uses:
In the "streamstats" function, it's creating two new fields: last(Txbytes) as lastTX, and last(Rxbytes) as lastRX. Later it subtracts the last value from the current value with: Eval RX_Thruput=lastRX-Rxbytes
The last() function gets the most recent value of a field and adds it to the current event. Remember that the default order of events in Splunk is reverse chronological order, so when an event gets the "last" value of a field it's getting it from a later time, so subtracting the "current" value from the "last" value give us the difference, which is the throughput for the period.
Best regards, Jon