topic Re: How can I find the difference between table rows? in Splunk Search

How can I find the difference between table rows?

sohaibomar — Sun, 17 Sep 2017 19:17:11 GMT

I have results in following table format:

half    app_name    dataconsumed
-----------------------------------
first_half    skype    50
first_half    facebook    90
first_half    yahoo    10
first_half    bing    30
second_half    skype    150
second_half    facebook    100
second_half    yahoo    5
second_half    bing    50

How should I find the difference in dataconsumed for ex (difference = secondhalf - firsthalf) and exclude app if difference is negative.

for above table result should be:

app    difference
------------------------
skype    100
facebook    10
bing    20

Note: In above result table yahoo is excluded since it's difference is negative.

Re: How can I find the difference between table rows?

DalJeanis — Sun, 17 Sep 2017 22:27:30 GMT

Try this...

| table half appname dataconsumed
| stats sum(eval(if(half="first_half",dataconsumed,null()))) as data1
   sum(eval(if(half="first_half",null(),dataconsumed))) as data2
   by appname
| eval difference=data2-data1
| where difference > 0

Re: How can I find the difference between table rows?

somesoni2 — Mon, 18 Sep 2017 04:27:04 GMT

Give this as well
Updated

your current search giving fields half, app_name, dataconsumed
| chart values(dataconsumed) over app_name by half
| eval difference=second_half-first_half
| where difference>0

Re: How can I find the difference between table rows?

DalJeanis — Mon, 18 Sep 2017 13:11:58 GMT

@somesoni2 nice. but difference>0

Re: How can I find the difference between table rows?

somesoni2 — Mon, 18 Sep 2017 14:29:32 GMT

Gosh... I can swear it was > in my mind while typing. Thanks @Daljeanis for correcting it..