Splunk Search

Dashboard

uagraw01
Motivator

I want difference between 155 and 132, how can i do with the Spl.

 

IMG_20201103_194436.jpg

0 Karma
1 Solution

renjith_nair
Legend

Try adding this to your search

Your search
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

Run anywhere search

|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

 

OR

Your search
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week
|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Try adding this to your search

Your search
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

Run anywhere search

|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

 

OR

Your search
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week
|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

uagraw01
Motivator

@renjith_nair  Thanks for your response. I need to add list of difference server also in my search how can i add ? Please help

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...