topic Re: Calculations on 2 different fields from 2 separate logs, newbie here in Splunk Search

Calculations on 2 different fields from 2 separate logs, newbie here

606866581 — Fri, 09 Aug 2013 10:07:40 GMT

Hi, I've got 2 log lines which look similar to this:

Thu Aug 08 16:45:01 2013 | Field1 : 25
Thu Aug 08 16:45:01 2013 | Field2 : 30

Does anyone know how to find Field3 which is (Field2-Field1)

I've tried:
| eval Field3=Field2-Field1 |

But because they're not from the same log line, Field3 is always null.
Any advice is appreciated!

martin_mueller — Fri, 09 Aug 2013 10:10:48 GMT

Is there some kind of grouping field that Splunk can use to match two lines together?

606866581 — Fri, 09 Aug 2013 10:13:43 GMT

unfortunately these logs are pretty bare, they're not much longer than the example above ^

martin_mueller — Fri, 09 Aug 2013 10:15:28 GMT

Are they reliably group-able by timestamp? If not, how should Splunk guess which two lines to match up?

606866581 — Fri, 09 Aug 2013 10:16:48 GMT

Actually yes, the timestamp is guaranteed to be exactly the same

martin_mueller — Fri, 09 Aug 2013 10:19:43 GMT

Assuming the two events have the same timestamp and no other events with that timestamp exist, you can do this:

... | eventstats first(Field1) as f1 first(Field2) as f2 by _time | eval f3 = f2 - f1

606866581 — Fri, 09 Aug 2013 10:28:12 GMT

Worked perfectly, Thanks!