topic Re: How to subtract filed values in a column in Splunk Search

How to subtract filed values in a column

ezamit — Wed, 31 Jan 2024 15:40:26 GMT

I have AWS Cloudtrail data and want to find out how long an EC2 instance was stopped. Is it possible to subtract the EpochOT from Row 3 to Row 2 and Row 5 to Row 4 etc..

Re: How to subtract filed values in a column

gcusello — Wed, 31 Jan 2024 15:44:43 GMT

Hi @ezamit,

di you explored the delta command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Delta)?

Ciao.

Giuseppe

Re: How to subtract filed values in a column

ezamit — Wed, 31 Jan 2024 15:56:41 GMT

Thanks @gcusello . That's a great suggestion. I added | delta EpochOT p=1 to the search and it gave me the following results

Is there a way we can do every other row in delta. I want Row 3 - Row 2, Row 5 - Row 4, Row 7 - Row 6 etc. Thanks again for your help

Re: How to subtract filed values in a column

ITWhisperer — Wed, 31 Jan 2024 16:20:41 GMT

| eval "delta(EpochOT)" = if(NO % 2 = 0, null(), 'delta(EpochOT)')

Re: How to subtract filed values in a column

gcusello — Wed, 31 Jan 2024 16:27:28 GMT

Hi @ezamit,

the solution from @ITWhisperer is perfect!

Ciao.

Giuseppe

Re: How to subtract filed values in a column

ezamit — Wed, 31 Jan 2024 18:32:55 GMT

😀Thanks Guys. it is working !!!!😀

Re: How to subtract filed values in a column

gcusello — Thu, 01 Feb 2024 06:58:43 GMT

Hi @ezamit ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉