topic Subtracting two fields in Splunk Search

Subtracting two fields

sintjm — Thu, 25 Jul 2024 16:09:55 GMT

I extracted 2 fields called 'Resp_time' and 'Req_time'...Both these fields are integers.
I also changed the values to epoch

How do I display the difference between the Resp_time and req_time?

Re: Subtracting two fields

gcusello — Thu, 25 Jul 2024 16:27:06 GMT

Hi @sintjm ,

if they are integers or they are in epochtime, you can calculate the difference using eval command:

<your_search> | eval diff=Resp_time-Req_time

Ciao.

Giuseppe

Re: Subtracting two fields

sintjm — Thu, 25 Jul 2024 16:42:43 GMT

Hi thanks but the problem is they are not from the same events as they are separate

Re: Subtracting two fields

yuanliu — Thu, 25 Jul 2024 18:24:47 GMT

You will need a common value in the two types of events to correlate events. For example, if each pair has a unique transaction ID, you can do

| stats values(Resp_time) as Resp_time values(Req_time) as Req_time by transaction_id | eval Resp_time - Req_time

Alternatively, if you have some other ways to determine a pairing, e.g., the two always happen within a deterministic interval, e.g., request comes in at 5 minute into the hour, a unique response is sent within the hour and NO other request would come in during the same hour, you can use that as criterion. There may be other conditions where you would use transaction. Unless you give us the exact condition, mathematically there is no solution.

Re: Subtracting two fields

gcusello — Fri, 26 Jul 2024 06:22:57 GMT

Hi @sintjm ,

as also @yuanliu said, you need a correlation key to correlate the events, if you have, you can use it in a stats command and this is the best solution:

<your_search> | stats values(Resp_time) AS Resp_time values(Req_time) AS Req_time BY key | eval diff=Resp_time-Req_time

If you haven't and you're sure that events are always sequential, you could use the transaction command:

<your_search> | transaction maxevents=2 | table duration

Ciao.

Giuseppe

Re: Subtracting two fields

sintjm — Fri, 26 Jul 2024 09:40:21 GMT

thanks, I used a correlation key to correlate the events and it worked.

Re: Subtracting two fields

sintjm — Fri, 26 Jul 2024 09:40:58 GMT

Helped a lot, thanks.