topic Re: How to subtract or minus the values in Splunk Enterprise

How to subtract or minus the values

phanichintha — Mon, 28 Jun 2021 12:39:52 GMT

Hello Team,

I have a query called:
host="mule1" OR host="mule2" Message="message: Start of Flow CreateUser flow" OR Message="message: All system calls for CREATE user is completed" | stats count by Message

Output:

But here I want in the output the third row should be Failures under Message column and First column minus(-) Second column count in Third column count.

Re: How to subtract or minus the values

ITWhisperer — Mon, 28 Jun 2021 13:02:35 GMT

| transpose 0 header_field=message | eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed' | transpose 0 column_name=message header_field=column

Re: How to subtract or minus the values

phanichintha — Mon, 28 Jun 2021 13:14:31 GMT

@ITWhisperer thanks for the swift response, i got the exact results.

Re: How to subtract or minus the values

amitshrigoel — Wed, 31 Jan 2024 00:45:37 GMT

I have a similar problem but i have to do it recursively e.g. 2nd row - 1st row, 4th - 3rd row, 6th - 5th and so on and so forth e.g. how can we do it in Splunk ( I am doing a workaround and exporting to Excel and then using = A2-A1, A4-A3). Is it possible to do it in the query itself.

Value

65. = 22

47. = 23

62. = 26

Re: How to subtract or minus the values

PickleRick — Wed, 31 Jan 2024 08:03:56 GMT

1. This is not recursion

2. This is an old thread with possibly low visibility. Please create a new thread, describe your problem, what data you have, what results you need to raise your chances of getting a meaningful response.

Re: How to subtract or minus the values

ITWhisperer — Wed, 31 Jan 2024 09:20:37 GMT

| streamstats count as row current=f last(Value) as previous | eval row=row%2 | eval diff=if(row=1,Value-previous*row,null()) | fields - previous row