topic Re: How to calculate with multiple values in a table? in Splunk Search

How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 08:44:36 GMT

I have few results which look like below in a table:

ID         Ask        Bid
1   |      4     |    3
2   |      5     |    6
3   |      7     |    8

I want to create new field with newfield=(4*6-8)/8
So how do I it?
All suggestions are welcome.

Re: How to calculate with multiple values in a table?

niketn — Tue, 29 Sep 2020 15:56:46 GMT

@dailv1808, what is the correlation/logic for picking up (4*6-8)/8?
Did you mean (3*6-8)/8, which are the values in Bid field?
Please elaborate for us to assist you better.

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 09:00:01 GMT

thank for your respond.
Yes. 6 and 8 are values in Bid field.
4 value in Ask field

Re: How to calculate with multiple values in a table?

niketn — Tue, 26 Sep 2017 09:02:28 GMT

Will your table be fixed size i.e. 3*3 and is the logic first value of Ask and 2nd and 3rd value of Bid?

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 09:07:52 GMT

yes, right. as you said. The table be fixed size 3*3 and the logic first value of Ask and 2nd and 3rd value of Bid

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 10:10:08 GMT

If you want to display net in ALL rows remove the final eval statement

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 10:19:19 GMT

I tried but it does not seem to work properly
You can see photo below
![alt text][1]

https://imgur.com/a/ZKdvP

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 10:25:49 GMT

I think what you expect and what you have descried is perhaps having gaps.

Are you getting net as 2?
sorry your image is not opening up

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 10:37:45 GMT

sorry, because my english is not good.
You can see the result of you search command in the image above by link https://imgur.com/a/ZKdvP.
My expectation is at the net field displaying the result of the operation (4 * 6-8)/8
look like
ID Ask Bid Net
1 | 4 | 3 | 2 << --- resuilt of (4 * 6-8) / 8
2 | 5 | 6 |
3 | 7 | 8 |

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 10:47:59 GMT

can you please replace the last table command with additional fields?
| table ID,Ask,Bid,t,prevt,z1,prevz1,final,net

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 10:49:13 GMT

see my reference screen shot below & please run the new table command as state above.

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 10:56:54 GMT

ha I think I figured out your issue... your row numbers....are they really 1,2 and 3?, can you add something like this and pass the results back?

| table ID,Ask,Bid,t,prevt,z1,prevz1,final,net,row

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 11:40:57 GMT

try this -

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 11:51:23 GMT

I tried with this search command but nothing displayed in the net field.
see my screenshot: https://imgur.com/a/ZuOl4

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 11:54:56 GMT

when i change to "table ID,Ask,Bid,t,prevt,z1,prevz1,final,net,row" then the row field show number 1,2 ,3. Other field t,prevt,z1,prevz1,final,net are not show enything.

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 11:56:46 GMT

Please check out my answer above

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 12:17:27 GMT

hmmm your fields - results.askprice etc are they in number format? I know it displays as number but sometimes it could be a string having numbers as characters.
Also, what is the source of your data, CSV or some log files?

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 12:51:22 GMT

i'm sure they are in number format. Because the source of data from Json log file.

{ [-]
   message:
   request: /api/v1/getmarket
   result: { [-]
     AskPrice: 0.07598950
     BTCVolume: 29.08189407
     BidPrice: 0.07590000
     BuyOrderCount: 102
     Change: -1.68
     HighPrice: 0.07998059
     LastPrice: 0.07590000
     LowPrice: 0.07200000
     MarketID: 87
     SellOrderCount: 103
     TradeCount: 516
     Volume: 29.08189407
   }
   success: 1
}

Re: How to calculate with multiple values in a table?

dailv1808 — Tue, 26 Sep 2017 12:55:35 GMT

I read your search command, but i cann't understand your idea. Could you plz explain them ?
I thing with other program languages or in exel, this issue is so easy. But In Splunk, it is so hard for me 😞

Re: How to calculate with multiple values in a table?

Sukisen1981 — Tue, 26 Sep 2017 13:19:23 GMT

Hi the fields as it is coming in statistics tab , maybe that is causing the issue...can you try this and replace the ID, ask, bid fields with the correct field names?

| sort ID
|eval results.AskPrice=tonumber(results.AskPrice)
| eval results.BidPrice = tonumber(results.BidPrice)...
rest of the query as in your screen shot