topic Re: Simple subtraction between two searches in Splunk Search

Simple subtraction between two searches

Fo — Sun, 03 Mar 2024 14:54:33 GMT

I have two very simple searches and I need to be able to get the difference. This is insanely hard for something that is so simple.

search index="first-app" sourcetype="first-app_application_log"
AND "eventType=IMPORTANT_CREATE_EVENT" | stats count

^ this result is 150

search index="second-app" sourcetype="second-app_application_log"
AND "eventType=IMPORTANT_CANCEL_EVENT" | stats count

^ this result is 5

I'm trying to figure out how to simply do the 150 - 5 to get 145. I've tried `set diff` `eval` a bunch of different ways with no luck. I'm going nuts.

Any help would be greatly appreciated!

Re: Simple subtraction between two searches

gcusello — Sun, 03 Mar 2024 15:29:40 GMT

Hi @Fo,

please try something like this:

(index="first-app" sourcetype="first-app_application_log" "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT") | stats count(eval(index="first-app")) AS "first_app" count(eval(index="second-app")) AS "second_app" | eval diff="first_app"-"second_app" | table diff

One additional hint: don't use minus char in field names because Splunk knows it as the minus sign, use underscore (_).

Ciao.

Giuseppe

Re: Simple subtraction between two searches

ITWhisperer — Mon, 04 Mar 2024 11:01:14 GMT

Correction to @gcusello 's suggestion - when you quote field names on the righthand side of an evaluation, you need to use single quotes not double quotes (otherwise, Splunk treats them as strings and you can't subtract on string from another as they are not numeric data types)

Re: Simple subtraction between two searches

gcusello — Mon, 04 Mar 2024 11:08:45 GMT

Hi @Fo ,

as hinted by @ITWhisperer it was a mistyping for this reason I hinted to avoid the minus char!

Ciao.

Giuseppe