Splunk Enterprise

How to subtract or minus the values

phanichintha
Path Finder

Hello Team,

I have a query called:
host="mule1" OR host="mule2" Message="message: Start of Flow CreateUser flow" OR Message="message: All system calls for CREATE user is completed" | stats count by Message

Output:

phanichintha_0-1624883529929.png

But here I want in the output the third row should be Failures under Message column and First column minus(-) Second column count in Third column count.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column

View solution in original post

0 Karma

phanichintha
Path Finder

@ITWhisperer thanks for the swift response, i got the exact results.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!