Hi, I've got 2 log lines which look similar to this:
Thu Aug 08 16:45:01 2013 | Field1 : 25
Thu Aug 08 16:45:01 2013 | Field2 : 30
Does anyone know how to find Field3 which is (Field2-Field1)
I've tried:
| eval Field3=Field2-Field1 |
But because they're not from the same log line, Field3 is always null.
Any advice is appreciated!
Assuming the two events have the same timestamp and no other events with that timestamp exist, you can do this:
... | eventstats first(Field1) as f1 first(Field2) as f2 by _time | eval f3 = f2 - f1
Assuming the two events have the same timestamp and no other events with that timestamp exist, you can do this:
... | eventstats first(Field1) as f1 first(Field2) as f2 by _time | eval f3 = f2 - f1
Worked perfectly, Thanks!
Actually yes, the timestamp is guaranteed to be exactly the same
Are they reliably group-able by timestamp? If not, how should Splunk guess which two lines to match up?
unfortunately these logs are pretty bare, they're not much longer than the example above ^
Is there some kind of grouping field that Splunk can use to match two lines together?