topic Re: How to subtract two fields? in Splunk Search

How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 20:00:46 GMT

I extracted 2 fields called 'Request' and 'Response'...Both these fields are integers.

How do I display the difference between the Response field and request field?

Re: How to subtract two fields?

aakwah — Tue, 03 Feb 2015 20:07:32 GMT

index=test | eval new_field = field1 - field2

Re: How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 20:12:18 GMT

Where would the output (the difference) be located? It's running the search and showing results but I do not see the new field 'Difference' anywhere in my search

I have:
index=test | eval Difference=Response-Request

Re: How to subtract two fields?

wpreston — Tue, 03 Feb 2015 20:15:08 GMT

Are Response and Request in the same event or are they in separate events?

Re: How to subtract two fields?

aakwah — Tue, 03 Feb 2015 20:17:11 GMT

you should find a new field added to interesting fields on the left hand side called Difference

Re: How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 20:20:23 GMT

Separate events.. I have a web service call which has a request/response pair. So I extracted the time from the request field then I did a search for the response field and extracted the time from the response. So now I want to have a new field which holds the difference from the response and request

Re: How to subtract two fields?

wpreston — Tue, 03 Feb 2015 20:30:50 GMT

Ok if they are in separate events you will first need to link them together using either stats or transaction. If you post some sample events we can help with correlating them if you need it. After you've linked/correlated the events you can use eval to get the difference in Response and Request. As a generic example, something like this:

... search terms here ... | transaction startswith="Request" endswith="Response" maxevents=2 | eval Difference=Response-Request

Re: How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 20:34:25 GMT

Yeah I see the 'Difference' field under Interesting fields but nothing is showing up when I click on it. Any suggestions?

Re: How to subtract two fields?

aakwah — Tue, 03 Feb 2015 20:38:57 GMT

I think @wpreston answer above is suitable as the events are separate

Re: How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 20:41:14 GMT

Yeah each request/response pair has a unique identifier.. So if I have the request and I want to find the response I can input that identifier (called a GUID) into the search and I can see both the request and response. So would my search look something like this?

...| transaction GUID="FF79-I348-3847" startswith="Request" endswith="Response" maxevents=2 | eval Difference=Response-Request

Re: How to subtract two fields?

wpreston — Tue, 03 Feb 2015 21:09:18 GMT

Very close! You don't have to put a specific GUID into the transaction statement, you just have to tell transaction which field to use to correlate the events. It would be this:

...| transaction GUID startswith="Request" endswith="Response" maxevents=2 | eval Difference=Response-Request

Re: How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 21:23:25 GMT

It's still not working, it's returning "results not found". I'm thinking it may be something to do with the startswith and endswith. The startswith should have the first word of the event and the endswith should have the last word of the event right? Where would I see the 'Difference' (output)? Would it be where the other fields are?

Re: How to subtract two fields?

wpreston — Tue, 03 Feb 2015 21:33:31 GMT

From the docs:

startswith = A search or eval filtering expression which, if satisfied by an event, marks the beginning of a new transaction.
endswith = A search or eval filtering expression which, if satisfied by an event, marks the end of a transaction.

So startswith should be a string or eval expression that identifies an event as the start of a transaction, and endswith should be a string or eval expression that identifies an event as the end of a transaction. See the docs on transaction here.

Your new Difference field will be over in the left side of the screen with the rest of the fields.

Re: How to subtract two fields?

masonmorales — Tue, 03 Feb 2015 21:38:44 GMT

It's still not working, it's returning
"results not found".

Is GUID an extracted field?

Re: How to subtract two fields?

skoelpin — Tue, 03 Feb 2015 21:40:54 GMT

Yes I extracted the unique identifier (FF79-I348-3847) and named it GUID

Re: How to subtract two fields?

skoelpin — Thu, 05 Feb 2015 14:18:55 GMT

I finally figured it out! The transaction command automatically took the difference but I just had to use 'duration'.. Below is my query for others who may need help

... | transaction GUID startswith="CalculateTaxRequest" endswith="CalculateTaxResponse" | top GUID by duration

Re: How to subtract two fields?

sintjm — Thu, 25 Jul 2024 11:08:34 GMT

hey a little years late but I'm just wondering if you changed the timestamp into epoch time before using the transaction command

Re: How to subtract two fields?

sintjm — Thu, 25 Jul 2024 11:29:10 GMT

hey a little years late but I'm just wondering if you changed the timestamp into epoch time before using the transaction command?

Re: How to subtract two fields?

DanielPi — Thu, 25 Jul 2024 12:07:14 GMT

Hi @sintjm ,

I’m a Community Moderator in the Splunk Community.

This question was posted 8 years ago, so it might not get the attention you need for your question to be answered. We recommend that you post a new question so that your issue can get the visibility it deserves. To increase your chances of getting help from the community, follow these guidelines in the Splunk Answers User Manual when creating your post.

Thank you!