|
Hi, I am new two splunk. I am wondering is there a way to calculate the delta of RXdropped from 5 minutes apart. 10:50:00 RXdropped 123 10:55:00 RXdropped 456 |
|
I did this it seems to work for now. index=os sourcetype="interfaces" host="prdcg4mdbl03.oss.prd" | multikv | eval PercError_PacketLoss=round(((Error * 100)/(RXbytes+TXbytes)),1) | eval StatusError = if(PercError_PacketLoss >= 1.0, "WARNING", "OK") | eval PercRX_PacketLoss=round(((RXdropped * 100)/RXbytes),1) | eval PercTX_PacketLoss=round(((TXdropped * 100)/TXbytes),1) | eval StatusRX = if(PercRX_PacketLoss >= 1.0, "WARNING", "OK") | eval StatusTX = if(PercTX_PacketLoss >= 1.0, "WARNING", "OK") | table time Name StatusError PercError_PacketLoss StatusRX PercRX_PacketLoss StatusTX PercTX_PacketLoss |
|
Hello! Welcome to Splunk! If you download the *NIX App, you'll find there is a dashboard for network traffic. Here's the link: Splunk for Unix and Linux on Splunkbase This is the search that the *nix app uses: In the "streamstats" function, it's creating two new fields: last(Txbytes) as lastTX, and last(Rxbytes) as lastRX. Later it subtracts the last value from the current value with: Eval RX_Thruput=lastRX-Rxbytes The last() function gets the most recent value of a field and adds it to the current event. Remember that the default order of events in Splunk is reverse chronological order, so when an event gets the "last" value of a field it's getting it from a later time, so subtracting the "current" value from the "last" value give us the difference, which is the throughput for the period. Best regards, Jon Hi Jon, Thanks for your fast response. I really appreciated that. The result is not what I expected. I am looking for the delta. Something like this. 456 - 123 = 333
(09 Nov '11, 11:23)
tdnguyen1
For some reasons, I could not get the right result using your query.
(09 Nov '11, 13:30)
tdnguyen1
It is calculating the delta. This eval statement subtracts Rxbytes from lastRX and assigns the result to RX_Thruput. In other words: It's not using RXdropped, but if you use RXdropped you'll get the results you want.
(09 Nov '11, 15:25)
Jon Webster
|
