https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194861#M20120 <P>There are two strings "abc" and "xyz", some values are assigned to the strings;<BR /> suppose say<BR /> abc: 50 and xyz: 45</P> <P>I want to write a quarry which yields a result like</P> <P>Result = (abc-xyz)<BR /> and compare if result &gt;= 75%</P> <P>Please help me in this.Thanks in advance.</P> Fri, 03 Jan 2014 13:35:37 GMT sowmya_kn 2014-01-03T13:35:37Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194861#M20120 <P>There are two strings "abc" and "xyz", some values are assigned to the strings;<BR /> suppose say<BR /> abc: 50 and xyz: 45</P> <P>I want to write a quarry which yields a result like</P> <P>Result = (abc-xyz)<BR /> and compare if result &gt;= 75%</P> <P>Please help me in this.Thanks in advance.</P> Fri, 03 Jan 2014 13:35:37 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194861#M20120 sowmya_kn 2014-01-03T13:35:37Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194862#M20121 <P>Your question is lacking a bit of information;</P> <UL> <LI>75% of what?</LI> <LI>Is <CODE>abc</CODE> always larger than <CODE>xyz</CODE>?</LI> </UL> <P>Anyway, here are a few examples of some arithmetic operations, but you should look up these pages as well;</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions</A></P> <PRE><CODE>your search here | eval diff = abc - xyz | your search here | eval absdiff = abs(abc - xyz) | your search here | eval ratio = xyz/abc | your search here | eval ratio = xyz/abc | where ratio &gt;=0.75 </CODE></PRE> <P>/K</P> Fri, 03 Jan 2014 13:57:29 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194862#M20121 kristian_kolb 2014-01-03T13:57:29Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194863#M20122 <BLOCKQUOTE> <P>75% of abc<BR /> yes abc is always larger than xyz</P> </BLOCKQUOTE> Fri, 03 Jan 2014 14:06:00 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194863#M20122 sowmya_kn 2014-01-03T14:06:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194864#M20123 <P>So the last of my examples should fit you nicely. Please upvote and/or mark the answer as accepted if your problem was solved.</P> <P>/K</P> Fri, 03 Jan 2014 14:31:31 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Getting-difference-of-two-string-values-and-calculating/m-p/194864#M20123 kristian_kolb 2014-01-03T14:31:31Z