topic Re: Make operations between two columns in Splunk Search

How to Make operations between two columns

nalagito — Thu, 19 May 2022 16:15:43 GMT

Hello, I have this query:

| mstats avg(_value) as packets WHERE index=metrics_index sourcetype=network_metrics (metric_name=*.out) ((metric_name="InterfaceEthernetA.*" OR metric_name="InterfaceEthernetB.*") AND (host="hostA" OR host="hostB")) span=1m by metric_name,host | rex field=metric_name ".*InterfaceEthernet(?<mn>\d_\d*)" | eval kbits=packets*8/1000 | timechart span=30m sum(kbits) by mn

It returns this results:

From those results, I would like to make operations generating another column with those results...

For example: (ColumnA - ColumnB) / ColumnA * 100

How could I do that?

Re: Make operations between two columns

gcusello — Thu, 19 May 2022 13:40:23 GMT

Hi @nalagito,

if the values of ColumnA and ColumnB are fixed, you can use the eval command to make the calculation you need.

If instead they aren't fixed, is much more complicated.

Ciao.

Giuseppe

Re: Make operations between two columns

nalagito — Thu, 19 May 2022 13:56:44 GMT

@gcusello

Could you please give me an example? What do you mean with "fixed"?

Re: Make operations between two columns

gcusello — Thu, 19 May 2022 14:52:14 GMT

Hi @nalagito,

if the values of mn are always:

my_mn1,
my_mn2.

in this case you can make operations using my_mn1 and my_mn2 as column name.

Ciao.

Giuseppe