topic Re: Splunk 640: How to eval the difference between events' values in Splunk Search

Splunk 640: How to eval the difference between events' values

htkwan — Mon, 09 May 2016 11:07:30 GMT

Hello Everybody,
I've a table (w/o the yellow column), as shown below. I want to eval another field (in yellow). It shows the difference between the LatestValue, by Category2, TagName, FiscalDate (number). Pls. advise. Thanks.

Re: Splunk 640: How to eval the difference between events' values

javiergn — Mon, 09 May 2016 11:13:29 GMT

You want to use delta:

your search here
| delta LatestValue as Diff p=1

By the way, make sure your events are sorted first. For instance:

your search here
| sort FiscalDate
| delta LatestValue as Diff p=1

If you need something more granular, such as only sum those where category and tag match then you can use streamstats probably or maybe just sort by FiscalDate, Category2, TagName.

Let me know if the above works for you anyway

Re: Splunk 640: How to eval the difference between events' values

htkwan — Mon, 09 May 2016 12:48:13 GMT

Hello Javiergn,
It works partially. See below.

It should be as below.

Re: Splunk 640: How to eval the difference between events' values

javiergn — Mon, 09 May 2016 12:59:46 GMT

If you don't want the negative numbers then simply append the following to your search:

| eval Diff = if (Diff < 0, "", Diff)

Re: Splunk 640: How to eval the difference between events' values

sundareshr — Mon, 09 May 2016 13:21:43 GMT

You could do as @javiergn suggested (set Diff to "" if negative). The risk with that if there are negative Diffs within a tag, you would lose those. Another option would be to use streamstats and group by tag. Like this

your search here | streamstats window=1 current=f first(LatestValue) as NextValue by TagName | eval Diff=LatestValue-NextValue