topic Re: How to perform subtraction on results? in Splunk Search

How to perform subtraction on results?

brosselle — Tue, 19 Jun 2018 15:03:23 GMT

I'm currently using this in a search:
index=OS sourcetype=cpu | timechart avg(pctIdle) by host

This typically gives a result of around 96% for the host I'm running the query on. I want to subtract that from 100 to give a result of 4%. I know this should be simple, but I haven't got it to work yet. Any help is appreciated!

Re: How to perform subtraction on results?

somesoni2 — Tue, 19 Jun 2018 16:18:30 GMT

So after you timechart command, you'll get column _time and one column for each host with name of the column being the host name (e.g. _time host1 host2 etc). How to do any operation on those fields, you'd need to use the exact field name (which is the host name), so you can either use the hardcoded name of the host like this (putting it in single quotes in the expression parts as it may have special chars)

index=OS sourcetype=cpu | timechart avg(pctIdle) by host
| eval "HardCodedHostName"=100-'HardCodedHostName'

OR if you want to do this for all host columns, you can use this foreach command (the <<FIELD>> to be used literally the way it's used here, no replacement required. see this for more details on foreach command)

index=OS sourcetype=cpu | timechart avg(pctIdle) by host
| foreach * [| eval "<<FIELD>>"=100-'<<FIELD>>']  [1]:

Re: How to perform subtraction on results?

PowerPacked — Tue, 19 Jun 2018 16:23:43 GMT

Hi @brosselle

try this below query

index=OS sourcetype=cpu | timechart avg(pctIdle) by host |eval calc = (100 - 'hostfieldnamefrompreviuosresults') | fields calc hostfieldnamefrompreviuosresults

Thanks

Re: How to perform subtraction on results?

brosselle — Tue, 19 Jun 2018 17:21:11 GMT

Wow. I would have never come up with this:
| foreach * [| eval "<>"=100-'<>']

Worked perfectly. Thank you!