topic subtraction doesn't work for multiple values in one field in Splunk Search

subtraction doesn't work for multiple values in one field

almond14 — Fri, 04 Dec 2015 21:44:50 GMT

I managed to create a table that somewhat looks like this:

However, when I tried to append a new column with the differences between after and before as its value, it just gave me a blank space. I used eval differences=after-before which apparently doesn't work. Is there some other workaround on this? I need to get the list of differences so the end result should look something like below:

I need to have that column so I can process the average, min, and max difference for each name1, name2, etc.

Thanks!

Re: subtraction doesn't work for multiple values in one field

sundareshr — Fri, 04 Dec 2015 22:26:45 GMT

Try this

.. | eval z=mvzip(before, after, "@") | mvexpand z | rex field=z "(?<before>.*)@(?<after>.*)" | table names, before, after | eval diff=after-before

Re: subtraction doesn't work for multiple values in one field

woodcock — Sat, 05 Dec 2015 20:25:31 GMT

See answer by @sundareshr but also tack on this:

... | stats list(before) AS before list(after) AS after list(diff) AS diff BY names