https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75330#M181339 <P>Hi ALL,</P> <P>I am using a transaction command to group two events together, "connect" and "disconnect". Both the events have a common field called bytes and I need to get the difference of the bytes delivered during the disconnect event and connect event. </P> <P>How can I achieve this ?</P> <PRE><CODE>(sourcetype="access" event="*connect" status="200") | transaction c_ip eventttype startswith="connect" endswith="disconnect" </CODE></PRE> <P>Thanks in Advance </P> <P>Aappreciate your help.</P> Tue, 21 Feb 2012 05:01:49 GMT KarunK 2012-02-21T05:01:49Z https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75330#M181339 <P>Hi ALL,</P> <P>I am using a transaction command to group two events together, "connect" and "disconnect". Both the events have a common field called bytes and I need to get the difference of the bytes delivered during the disconnect event and connect event. </P> <P>How can I achieve this ?</P> <PRE><CODE>(sourcetype="access" event="*connect" status="200") | transaction c_ip eventttype startswith="connect" endswith="disconnect" </CODE></PRE> <P>Thanks in Advance </P> <P>Aappreciate your help.</P> Tue, 21 Feb 2012 05:01:49 GMT https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75330#M181339 KarunK 2012-02-21T05:01:49Z https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75331#M181340 <P>Use <CODE>mvlist=t</CODE> as a parameter to <CODE>transaction</CODE> to make sure you're getting field values in the correct (chronological) order, then use <CODE>mvindex</CODE> to get the first and last value for <CODE>bytes</CODE>.</P> <PRE><CODE>... | transaction mvlist=t c_ip eventtype startswith="connect" endswith="disconnect" | eval bytesdiff=tonumber(mvindex(bytes,-1))-tonumber(mvindex(bytes,0)) </CODE></PRE> Tue, 21 Feb 2012 08:11:27 GMT https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75331#M181340 Ayn 2012-02-21T08:11:27Z https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75332#M181341 <P>Thanks Ayn. It worked....</P> Wed, 22 Feb 2012 05:42:04 GMT https://community.splunk.com/t5/Splunk-Search/difference-of-two-values-of-same-field-inside-a-transcation/m-p/75332#M181341 KarunK 2012-02-22T05:42:04Z