topic Re: Subtraction of multiple values in same cell in Splunk Search

Subtraction of multiple values in same cell

shivaa — Wed, 30 Jun 2021 13:03:13 GMT

So I’m pretty new to splunk and I do feel like this should be a lot simpler than I’m making it.

I need two epoch times that are in the same cell to be substracted from each other and I haven’t been able to find anything that can help with it or figure it out myself. I didn't want to use mvexpand because I want the subtraction to be based off of the user

My search result looks like this rn:

Name

Epoch

UserA

1625037039

1625037045

UserB

1625050381

1625050423

Re: Subtraction of multiple values in same cell

ITWhisperer — Wed, 30 Jun 2021 13:24:39 GMT

| eval epoch=mvindex(epoch,1)-mvindex(epoch,0)

Re: Subtraction of multiple values in same cell

shivaa — Wed, 30 Jun 2021 14:57:25 GMT

Hey, thank you for your reply. However I get the following error 😞
-> Error in 'eval' command: Type checking failed. '-' only takes numbers.

Re: Subtraction of multiple values in same cell

kamlesh_vaghela — Wed, 30 Jun 2021 15:03:42 GMT

@shivaa

Can you please try this?

YOUR_SEARCH | eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))

My Sample Search :

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Subtraction of multiple values in same cell

shivaa — Thu, 01 Jul 2021 06:14:13 GMT

worked like a charm, thank you so much! 🙂