Monitoring Splunk

How to get the difference of value between two tables?

aaa2324
Explorer

Hi Team,

I need to find difference between two tables and generate an alert when the diffence between Table B and Table A is greater than 3 and publish the diffence in table. Kindly help on this

Table A       Table B   

3234          3240

4234           4236

2345           2348

1345           1349

Labels (1)
0 Karma

tshah-splunk
Splunk Employee
Splunk Employee

Hey @aaa2324 ,

Try renaming the columns in the table and remove the spaces in the column name and then you'll be able to calculate the difference easily. Your query should look something like below:

 

<<your_base_query>>
| rename "Table A" as Table_A "Table B" as Table_B
| eval diff=Table_B-Table_A

 

And then you can save this search as an alert and have the alert triggered if diff>3.

---
If you find the answer helpful, an upvote/karma is appreciated
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...