topic Re: Perform SUM and DIFF on multiple fields in Splunk Search

topic Re: Perform SUM and DIFF on multiple fields in Splunk Search https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/554446#M157379 <P>Thank you <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>  for your feedback.</P><P>I have tried your hint but i'am not getting the first line as expected :</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Atif_1-1622797387715.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14469iF28ADFFE081E3003/image-size/medium?v=v2&px=400" role="button" title="Atif_1-1622797387715.png" alt="Atif_1-1622797387715.png" /></span></P><P> </P> Fri, 04 Jun 2021 09:04:01 GMT Atif 2021-06-04T09:04:01Z Perform SUM and DIFF on multiple fields https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/553559#M157164 <P>Hi,</P><P>I'am sending some events each minute to Splunk :</P><P> </P><TABLE border="1" width="93.8500398682443%"><TBODY><TR><TD width="25%" height="24px">TIME</TD><TD width="25%" height="24px">ID</TD><TD width="25%" height="24px">IN</TD><TD width="25%" height="24px">OUT</TD></TR><TR><TD width="25%" height="24px">08:00</TD><TD width="25%" height="24px">A</TD><TD width="25%" height="24px">1</TD><TD width="25%" height="24px">0</TD></TR><TR><TD width="25%" height="24px">08:00</TD><TD width="25%" height="24px">B</TD><TD width="25%" height="24px">0</TD><TD width="25%" height="24px">0</TD></TR><TR><TD width="25%" height="24px"> </TD><TD width="25%" height="24px"> </TD><TD width="25%" height="24px"> </TD><TD width="25%" height="24px"> </TD></TR><TR><TD width="25%" height="24px">08:01</TD><TD width="25%" height="24px">A</TD><TD width="25%" height="24px">2</TD><TD width="25%" height="24px">1</TD></TR><TR><TD width="25%" height="24px">08:01</TD><TD width="25%" height="24px">B</TD><TD width="25%" height="24px">2</TD><TD width="25%" height="24px">2</TD></TR><TR><TD width="25%" height="24px">08:01</TD><TD width="25%" height="24px">C</TD><TD width="25%" height="24px">4</TD><TD width="25%" height="24px">0</TD></TR><TR><TD width="25%" height="24px"> </TD><TD width="25%" height="24px"> </TD><TD width="25%" height="24px"> </TD><TD width="25%" height="24px"> </TD></TR><TR><TD height="22px">08:02</TD><TD height="22px">A</TD><TD height="22px">3</TD><TD height="22px">3</TD></TR><TR><TD height="22px">08:02</TD><TD height="22px">B</TD><TD height="22px">3</TD><TD height="22px">2</TD></TR><TR><TD height="22px"> </TD><TD height="22px"> </TD><TD height="22px"> </TD><TD height="22px"> </TD></TR><TR><TD height="22px">08:03</TD><TD height="22px">A</TD><TD height="22px">6</TD><TD height="22px">4</TD></TR><TR><TD height="22px">08:03</TD><TD height="22px">B</TD><TD height="22px">3</TD><TD height="22px">3</TD></TR><TR><TD height="22px"> </TD><TD height="22px"> </TD><TD height="22px"> </TD><TD height="22px"> </TD></TR><TR><TD height="22px">08:04</TD><TD height="22px">A</TD><TD height="22px">6</TD><TD height="22px">4</TD></TR><TR><TD height="22px">08:04</TD><TD height="22px">B</TD><TD height="22px">3</TD><TD height="22px">3</TD></TR><TR><TD height="22px">08:04</TD><TD height="22px">C</TD><TD height="22px">4</TD><TD height="22px">2</TD></TR><TR><TD height="22px"> </TD><TD height="22px"> </TD><TD height="22px"> </TD><TD height="22px"> </TD></TR><TR><TD height="22px">08:05</TD><TD height="22px">A</TD><TD height="22px">6</TD><TD height="22px">4</TD></TR><TR><TD height="22px">08:05</TD><TD height="22px">B</TD><TD height="22px">3</TD><TD height="22px">3</TD></TR><TR><TD height="22px">08:05</TD><TD height="22px">C</TD><TD height="22px">4</TD><TD height="22px">2</TD></TR></TBODY></TABLE><P> </P><P>What i'am trying to get as a result is :</P><TABLE border="1" width="100%"><TBODY><TR><TD width="33.333333333333336%" height="24px">TIME</TD><TD width="33.333333333333336%" height="24px">SUMIN - PREVIOUS_SUMIN</TD><TD width="33.333333333333336%" height="24px">SUMOUT - PREVIOUS_SUMOUT</TD></TR><TR><TD width="33.333333333333336%" height="24px">08:00</TD><TD width="33.333333333333336%" height="24px">=1+0 = 1</TD><TD width="33.333333333333336%" height="24px">=0+0 = 0</TD></TR><TR><TD width="33.333333333333336%" height="24px">08:01</TD><TD width="33.333333333333336%" height="24px">=2+2+4 - (1+0) = 7</TD><TD width="33.333333333333336%" height="24px">=1+2+0 - (0+0) = 3</TD></TR><TR><TD width="33.333333333333336%" height="24px">08:02</TD><TD width="33.333333333333336%" height="24px">=3+3 - (2+2+4) = -2</TD><TD width="33.333333333333336%" height="24px">=3+2 - (1+2+0) = 2</TD></TR><TR><TD width="33.333333333333336%" height="24px">08:03</TD><TD width="33.333333333333336%" height="24px">=6+3 - (3+3) = 3</TD><TD width="33.333333333333336%" height="24px">=4+3 - (3+2) = 2</TD></TR><TR><TD width="33.333333333333336%" height="22px">08:04</TD><TD width="33.333333333333336%" height="22px">=6+3+4 - (6+3) = 4</TD><TD width="33.333333333333336%" height="22px">=4+3+2 - (4+3) = 2</TD></TR><TR><TD height="22px">08:05</TD><TD height="22px">=6+3+4 - (6+3+4) = 0</TD><TD height="22px">=4+3+2 - (4+3+2) = 0</TD></TR></TBODY></TABLE><P> </P><P>After that i need to plot the two columns using a timechart by TIME</P><P> </P><P>Any hints are welcome.</P><P> </P><P>Thank you guys</P> Fri, 28 May 2021 17:17:15 GMT https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/553559#M157164 Atif 2021-05-28T17:17:15Z Re: Perform SUM and DIFF on multiple fields https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/553590#M157174 <LI-CODE lang="markup">| bin span=1m time | stats sum(in) as in sum(out) as out by time | streamstats window=1 current=f values(in) as previous_in values(out) as previous_out | eval in_change=in-previous_in | eval out_change=out-previous_out | table time in_change out_change</LI-CODE> Fri, 28 May 2021 21:20:38 GMT https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/553590#M157174 ITWhisperer 2021-05-28T21:20:38Z Re: Perform SUM and DIFF on multiple fields https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/554446#M157379 <P>Thank you <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>  for your feedback.</P><P>I have tried your hint but i'am not getting the first line as expected :</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Atif_1-1622797387715.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14469iF28ADFFE081E3003/image-size/medium?v=v2&px=400" role="button" title="Atif_1-1622797387715.png" alt="Atif_1-1622797387715.png" /></span></P><P> </P> Fri, 04 Jun 2021 09:04:01 GMT https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/554446#M157379 Atif 2021-06-04T09:04:01Z Re: Perform SUM and DIFF on multiple fields https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/554459#M157386 <LI-CODE lang="markup">| bin span=1m time | stats sum(in) as in sum(out) as out by time | streamstats window=1 current=f values(in) as previous_in values(out) as previous_out | fillnull value=0 previous_in previous_out | eval in_change=in-previous_in | eval out_change=out-previous_out | table time in_change out_change</LI-CODE> Fri, 04 Jun 2021 09:56:06 GMT https://community.splunk.com/t5/Splunk-Search/Perform-SUM-and-DIFF-on-multiple-fields/m-p/554459#M157386 ITWhisperer 2021-06-04T09:56:06Z