Reporting

How to subtract multivalues to a single value?

andres91302
Communicator

Hello everyone,

 

I have been bumping my head trying to subtract a list of values from a single value after I use the stats command.

 

I have something like this:

 

| stats values(TIME_ALERT) as "TIME ALERT" values(TIME_FRAUD) as "TIME FRAUD" by ID

 

TIME ALERTTIME FRAUDID

1647854522
1647854525
1647854529

1658452541UYU_UIS007

 

But what I want is something like this:

TIME ALERTDIFFTIME FRAUDID

1647854522
1647854525
1647854529

-10598019
-10598016
-10598012
1658452541UYU_UIS007

which is doing DIFF= TIME ALERT - TIME FRAUD, knowing that TIME FRAUD will always be a single value... thank you so much guys for your help

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use mvmap

| makeresults
| eval _raw="1647854522,1647854525,1647854529|1658452541|UYU_UIS007"
| eval alert=mvindex(split(_raw,"|"),0)
| eval fraud=mvindex(split(_raw,"|"),1)
| eval id=mvindex(split(_raw,"|"),2)
| eval alert=split(alert,",")
| fields alert,fraud,id
| fields - _*


| eval diff=mvmap(alert,alert-fraud)
0 Karma

andres91302
Communicator

hey @ITWhisperer  that was awesome thank you I dindt know that function was so usaful thank you so much my friend! Could you please let me know how would I choose from the diff field whihc is the smallest positive number? 

I am trying by addig

 

| where diff>0
| eval spn=min(diff)

 

but it is not working for me Thank you so much for your help man!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where diff>0
| sort 1 diff
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...