Splunk Search

Attempting to run eval using value from min row returned by stats

hzane
Engager

I have a list of events with columns such as:
type,event_time,event_id,create_date

My objective is to find the lowest event_time and subtract the create date to pop out a calculated value, called here "ttn".

index=events 
type=notification 
|stats min(event_time) as init_time by event_id
|eval ttn = init_time - create_date

It seems so close! If I change create_date to a number, that works. I was experimenting with appendpipe but to no avail.
This is my first week using Splunk and figuring out how to combine stats and eval in this manner is going to help immensely.

Thank you.

0 Karma
1 Solution

hzane
Engager

I ended up getting the desired result by nesting my eval statement inside the stats clause.

stats min(eval(event_time-create_date)) as ttn by tid

Pretty easy. Now if I can get these joins to work I will be home free!

View solution in original post

0 Karma

hzane
Engager

I ended up getting the desired result by nesting my eval statement inside the stats clause.

stats min(eval(event_time-create_date)) as ttn by tid

Pretty easy. Now if I can get these joins to work I will be home free!

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...