topic Re: How to calculate values in two fields ? in Splunk Search

How to calculate values in two fields ?

mah — Wed, 14 Oct 2020 14:54:54 GMT

hi,

My issue is I have a table like that :

I want to create an third column that create the result of :

first line = field1 - field2=field3

second line = first line field3 + second line field1 - second line field2=new field3

third line = second line field3 + third line field1 - third line field2=new field3

etc...

Can you help me ?

Thanks!

ITWhisperer — Wed, 14 Oct 2020 16:42:45 GMT

| autoregress field_3 | fillnull value=0 field_3_p1 | eval field_3=field_3_p1+field_1-field_2

The fillnull may be redundant

mah — Thu, 15 Oct 2020 07:22:02 GMT

hi,

the result is wrong :

You can see that the field_3 is not correct because it must be LAST field_3+field IN - field OUT

the field_3 here just calculate field IN - field OUT.

example of line 5 : -2 (last field_3)+4-0=2 and not 4

Can we do that ?

ITWhisperer — Thu, 15 Oct 2020 07:25:08 GMT

Please share the query you used to get this result

mah — Thu, 15 Oct 2020 07:30:47 GMT

I just add your commands after my chart command :

| chart count(user) over _time by type
| autoregress field_3
| fillnull value=0 field_3_p1
| eval field_3=field_3_p1+IN-OUT

result :

ITWhisperer — Thu, 15 Oct 2020 07:38:25 GMT

I thought the autoregress would be dynamic - it isn't. Try

| eval change=IN-OUT | streamstats sum(change) as f3

mah — Thu, 15 Oct 2020 07:46:08 GMT

It is perfect !

Thank you !