https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77185#M19522 <P>Well now I just feel silly :). All my searching, and I never found the 'where' command. Thank you!</P> Sun, 17 Jun 2012 17:36:34 GMT tslnmx 2012-06-17T17:36:34Z https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77183#M19520 <P>My log messages have two fields I'd like to search on: engineElapsed and serviceElapsed. I'm interested in looking at all the records where engineElapsed - serviceElapsed &gt; 1.</P> <P>I'm new to Splunk, and have discovered I can do do something like this:</P> <PRE><CODE>* | eval time=engineElapsed-serviceElapsed | timechart avg(time) by user </CODE></PRE> <P>But since I need to see individual log messages, something like this might be more suited -- if it worked, that is:</P> <PRE><CODE>eval(engineElapsed-serviceElapsed) </CODE></PRE> <P>Help would be appreciated <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sun, 17 Jun 2012 15:15:05 GMT https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77183#M19520 tslnmx 2012-06-17T15:15:05Z https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77184#M19521 <P>Have you tried this?</P> <PRE><CODE>* | where (engineElapsed - serviceElapsed) &gt; 1 </CODE></PRE> Sun, 17 Jun 2012 15:21:59 GMT https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77184#M19521 dwaddle 2012-06-17T15:21:59Z https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77185#M19522 <P>Well now I just feel silly :). All my searching, and I never found the 'where' command. Thank you!</P> Sun, 17 Jun 2012 17:36:34 GMT https://community.splunk.com/t5/Splunk-Search/Searching-where-a-difference-in-fields-is-greater-than-1/m-p/77185#M19522 tslnmx 2012-06-17T17:36:34Z