Splunk Search

## Calculate difference of fields where certain field value exists

Explorer

For each Digit I have below (Digit 0,2,3,4,5,7,8) I want to calculate the difference in time between the TXN endtime and the FW endTime for that digit. How can i group this new calculated one value for each digit?

``````index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| table jobName Digit endTime endTimeEpoch status
| sort -Digit
``````

Tags (1)
1 Solution
Ultra Champion

extract the "digit" value
`|rex field=Digit "Digit (?P<digitValue>\d)"`

rewrite _time to be endTimeEpoch
`|eval _time = endTimeEpoch`

use transaction to group them
`|transaction digitValue startswith=*FW endswith=*TXN`

retable
`| table jobName Digit digitValue endTime endTimeEpoch status duration`

So in full:

``````index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| rex field=Digit "Digit (?P<digitValue>\d)"
| eval _time = endTimeEpoch
| transaction digitValue startswith=*FW endswith=*TXN
| table jobName Digit digitValue endTime endTimeEpoch status duration
| sort -Digit
``````
If my comment helps, please give it a thumbs up!
Ultra Champion

extract the "digit" value
`|rex field=Digit "Digit (?P<digitValue>\d)"`

rewrite _time to be endTimeEpoch
`|eval _time = endTimeEpoch`

use transaction to group them
`|transaction digitValue startswith=*FW endswith=*TXN`

retable
`| table jobName Digit digitValue endTime endTimeEpoch status duration`

So in full:

``````index=
jobName = (all job names here)
| lookup digit_processing.csv jobName as jobName output Digit as Digit
| eval endTimeEpoch = strptime(endTime, "%Y-%m-%d %H:%M:%S")
| rex field=Digit "Digit (?P<digitValue>\d)"
| eval _time = endTimeEpoch
| transaction digitValue startswith=*FW endswith=*TXN
| table jobName Digit digitValue endTime endTimeEpoch status duration
| sort -Digit
``````
If my comment helps, please give it a thumbs up!
Explorer

Thank you!

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...