Required arguments

Optional arguments

1. Calculate the difference in activity

With the logs from a cable TV provider, sourcetype=tv, you can analyze broadcasting ratings, customer preferences, and so on. Which channels do subscribers watch the most, activity=view, and how long do the subscribers stay on those channels?

sourcetype=tv activity="View" | sort - _time | delta _time AS timeDeltaS | eval timeDeltaS=abs(timeDeltaS) | stats sum(timeDeltaS) by ChannelName

2. Calculate the difference between that current value and the 3rd previous value

Compute the difference between current value of count and the 3rd previous value of count and store the result in the default field, delta(fieldname), which in this example is delta(count).

... | delta count p=3

3. Calculate the difference between that current value and the previous value and rename the result field

For each event where 'count' exists, compute the difference between count and its previous value and store the result in the field countdiff.

... | delta count AS countdiff

1. Calculate the difference in the number of purchases between the top 10 buyers

Find the top ten people who bought something yesterday, count how many purchases they made and the difference in the number of purchases between each buyer.

sourcetype=access_* status=200 action=purchase | top clientip | delta count p=1

• The purchase events, action=purchase, are piped into the top command to find the top ten users, based on clientip, who bought something.
• These results, which include a count for each clientip are then piped into the delta command to calculate the difference between the count value of one event and the count value of the event preceding it, using the p=1 argument.
• By default, this difference is saved in a new field called delta(count).
• The first event does not have a delta(count) value.

The results look something like this:

2. Calculate the difference in time between recent events

Calculate the difference in time between each of the recent earthquakes in Alaska. Run the search using the time range All time.

source=all_month.csv place=*alaska* | delta _time p=1  | rename delta(_time) AS timeDeltaS | eval timeDeltaS=abs(timeDeltaS) | eval "Time Between Quakes"=tostring(timeDeltaS,"duration") | table place, _time, "Time Between Quakes"

• This example searches for earthquakes in Alaska.

The delta command is used to calculate the difference in the timestamps, _time, between each earthquake and the one immediately before it. By default the difference is placed in a new field called delta(_time). The time is in seconds.

• The rename command is used to change the default field name to timeDeltaS.
• An eval command is used with the abs function to convert the time into the absolute value of the time. This conversion is necessary because the differences between one earthquake and the earthquake immediately before it result in negative values.
• Another eval command is used with the tostring function to convert the time, in seconds, into a string value. The duration argument is part of the tostring function that specifies to convert the value to a readable time format HH:MM:SS.

The results look something like this:

3. Calculate the difference in time between consecutive transactions

Calculate the difference in time between consecutive transactions.

sourcetype=access_* | transaction JSESSIONID clientip startswith="view" endswith="purchase" | delta _time AS timeDelta p=1 | eval timeDelta=abs(timeDelta) | eval timeDelta=tostring(timeDelta,"duration")

• This example groups events into transactions if they have the same values of JSESSIONID and clientip.
• The beginning of a transaction is defined by an event that contains the string view. The end of a transaction is defined by an event that contains the string purchase. The keywords view and purchase correspond to the values of the action field. You might also notice other values for the action field, such as addtocart and remove.
• The transactions are then piped into the delta command, which uses the _time field to calculate the time between one transaction and the transaction immediately preceding it. Specifically the difference between the timestamp for the last event in the transaction and the timestamp in the last event in the previous transaction.
• The search renames the time change as timeDelta.
• An eval command is used with the abs function to convert the time into the absolute value of the time. This conversion is necessary because the differences between one transaction and the previous transaction it result in negative values.
• Another eval command is used with the tostring function to convert the time, in seconds, into a string value. The duration argument is part of the tostring function that specifies to convert the value to a readable time format HH:MM:SS.