I would like to evaluate the difference between two events (in theory the events contain completely different data). Let's say I have the following events:
timestap1 81 115 42683 1267 0 0
the third column corresponds to the field Total_Sent and I want to raise an alert if the field is not growing. How can I do: Toal_Sent1 - Total_Sent2 (in my case 42683 - 42683) and check if the result is greater than 5 ?
Thanks from a splunk newbie
Have you tried the "delta" search operator?
Delta will find the different between the same extracted field in consecutive events. You will probably need to define field extractions for your fields in order to be able to use delta against them.
answered 08 Sep '10, 14:50