https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115287#M30537 <P>You cannot do maths at index time, you're limited to regular expressions.</P> Thu, 09 Jul 2015 21:55:59 GMT martin_mueller 2015-07-09T21:55:59Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115281#M30531 <P>would like to know how to get subtraction of field value in two different events <BR /> i mean i have event A with field sum = 15 <BR /> and event B with field sum = 20 <BR /> i would like to create new field called diff that contain value = field of event B - field of event A </P> <P>thanks in advance </P> Thu, 09 Jul 2015 21:23:19 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115281#M30531 Ahmedkhalil 2015-07-09T21:23:19Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115282#M30532 <P>Hi Ahmedkhalil,</P> <P>you can use <CODE>streamstats</CODE> to achieve it. Using <CODE>streamstats</CODE> like this:</P> <PRE><CODE>your base search here| streamstats current=f last(sum) AS last | eval diff=sum-last | table event sum diff </CODE></PRE> <P>Hope this helps ...</P> <P>cheers, MuS</P> Thu, 09 Jul 2015 21:31:42 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115282#M30532 MuS 2015-07-09T21:31:42Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115283#M30533 <P>i would like to get difference between two fields not summation <BR /> and also this events is transaction<BR /> so i need to get difference between events in same transaction </P> Thu, 09 Jul 2015 21:38:39 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115283#M30533 Ahmedkhalil 2015-07-09T21:38:39Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115284#M30534 <P>What you are looking for is delta command</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Delta">http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Delta</A></P> Thu, 09 Jul 2015 21:41:38 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115284#M30534 pradeepkumarg 2015-07-09T21:41:38Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115285#M30535 <P>Sorry my bad, I'm still a bit sleepy <span class="lia-unicode-emoji" title=":winking_face:">😉</span> BTW your question states it's two events and not one transaction event.</P> Thu, 09 Jul 2015 21:54:34 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115285#M30535 MuS 2015-07-09T21:54:34Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115286#M30536 <P>ok it's good start how can i do this task at index time not search time </P> Thu, 09 Jul 2015 21:55:12 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115286#M30536 Ahmedkhalil 2015-07-09T21:55:12Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115287#M30537 <P>You cannot do maths at index time, you're limited to regular expressions.</P> Thu, 09 Jul 2015 21:55:59 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115287#M30537 martin_mueller 2015-07-09T21:55:59Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115288#M30538 <P>Another addition; if this is really in a Splunk <CODE>transaction</CODE> event, it will not work with <CODE>delta</CODE> nor <CODE>streamstats</CODE>. Both commands do their thing event based: </P> <PRE><CODE> For each event where field is a number, the delta command computes the difference, in search order, between the field value for the event and the field value for the previous event. The delta command writes this difference into newfield </CODE></PRE> <P>The same is with streamstats ....</P> Thu, 09 Jul 2015 22:09:46 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115288#M30538 MuS 2015-07-09T22:09:46Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115289#M30539 <P>but below example from search referance delta examples and contain same example that i can use <BR /> sourcetype=access_* | transaction JSESSIONID clientip startswith="view" endswith="purchase" | delta _time AS timeDelta p=1 | eval timeDelta=abs(timeDelta) | eval timeDelta=tostring(timeDelta,"duration")</P> Thu, 09 Jul 2015 23:32:30 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115289#M30539 Ahmedkhalil 2015-07-09T23:32:30Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115290#M30540 <P>ok but problem is that i will use this field many times in dashboards and it's alot of data So execute this search command each time will make reports and dashboard slow</P> Thu, 09 Jul 2015 23:33:29 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115290#M30540 Ahmedkhalil 2015-07-09T23:33:29Z https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115291#M30541 <P>Yes, if your after transaction event has a single value field which can be used with <CODE>delta</CODE> it will work....But you have a transaction with a multi value field called <CODE>sum</CODE> and this cannot be used in <CODE>delta</CODE> .....</P> Fri, 10 Jul 2015 01:13:48 GMT https://community.splunk.com/t5/Splunk-Search/would-like-to-know-how-to-get-subtraction-of-field-value-in-two/m-p/115291#M30541 MuS 2015-07-10T01:13:48Z