Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Delta on serveral fields, separate by id

$
0
0

I have multiple events like :

field 1; otherTimestamp; field2;field3;field4 test;1371481920.000000,value2,valeu3... test,1371481980.000000,value4,value5... otherttest,1371481920.000000,value...

I want to compute a delta on the othertimestamp field, but the delta should be 0, if the field1 changed... I also want to see all other fields for each event.

I tried to use delta, but I couldn't make delta begin at 0, on field1 changed...

I've tried to put a | transaction field1 | in front of the delta, but then all the lines are in a single event, and I'd like distinct events...

Can I do it with streamstats somehow ? what is the best way

alt text


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>