topic Re: Arithmetic operation on fields from different events in Splunk Search

Arithmetic operation on fields from different events

sstanlee — Mon, 17 Aug 2020 17:13:36 GMT

Consider the below types of events

fields : OS transaction numbers

Events: Win purchased 150

Unix purchased 200

Win sold 100

Unix sold 125

I want the results to be:

OS InHand(purchased-sold)

Win 50

Unix 75

How to do this?

thambisetty — Mon, 17 Aug 2020 19:07:27 GMT

upvote if my answer solves your problem.

sstanlee — Mon, 17 Aug 2020 19:49:02 GMT

I didn't get the results.

<Index Search>|

in verbose mode returns

1. OS=Win Category=purchased Numbers=100

2. OS=Unix Category=purchased Numbers= 200

3. OS=Win Category=sold Number=50

4. OS=Unix Category=sold Number=125

My search scenario is, if OS is Windows, I want to calculate the remaining count which is purchased - sold. How to do this.

thambisetty — Mon, 17 Aug 2020 20:02:53 GMT

I have shared query for the values you posted. I tried before posting and its working

to4kawa — Mon, 17 Aug 2020 21:47:43 GMT

sstanlee — Tue, 18 Aug 2020 16:30:59 GMT

I had more than 100 lines of data, but I quoted few as example.Initially it didnt work. I modified few of your code and it worked. Thanks a lot.

sstanlee — Tue, 18 Aug 2020 16:31:35 GMT

It worked. Thanks a lot.