topic Re: How to find the difference between the max value and the min value in the multi-value field combined by transaction? in Splunk Search

How to find the difference between the max value and the min value in the multi-value field combined by transaction?

Msugiyama — Wed, 13 Apr 2022 15:19:45 GMT

I want to find the difference between the maximum value and the minimum value in the multi-value field that has been lumped together with the transaction command.

Specifically, group the web access logs by ID, and then
I would like to find the time that the ID was operating from login to operation to logout.

Do you have an idea for SPL?

Re: How to find the difference between the max value and the min value in the multi-value field combined by transaction?

richgalloway — Wed, 13 Apr 2022 15:44:17 GMT

Can you tell us more about this use case? What is the query? What type of data are you comparing?

Check out the mvstats app (https://splunkbase.splunk.com/app/5198/) for functions that work with multivalue fields.

Re: How to find the difference between the max value and the min value in the multi-value field combined by transaction?

venky1544 — Wed, 13 Apr 2022 15:47:26 GMT

hi @Msugiyama

if you could share some sample data thats would be great for more people to pitch in

and are you asking two different questions here

about the diff of the max and min value clubbed together by transaction command you can try something like this

and about the group the web access logs by ID you can use the stats command

but would appreciate if you could throw more sample data

if the reply helps karma points are appreciated

Re: How to find the difference between the max value and the min value in the multi-value field combined by transaction?

Msugiyama — Thu, 14 Apr 2022 00:15:15 GMT

|makeresults
|eval txnid=1234, value=40
|append [|makeresults |eval txnid=1234, value=20]
|transaction txnid |eval diff = abs(tonumber(mvindex(value, 0)) - tonumber(mvindex(value, 1)))
|table diff

@venky1544
This is it!
Thank you so much. I solved it with this SPL.
Best regard.

@richgalloway
Thank you too.
I will read the page that guided me.

Re: How to find the difference between the max value and the min value in the multi-value field combined by transaction?

venky1544 — Thu, 14 Apr 2022 09:28:59 GMT

Hi @Msugiyama

if the solutions has helped you can you please accept it as solution as it might help others

thanks

Njoy splunking

venky1544