Counter 1 - Perfmon: Inbound Data rate
Counter 2 - Perfmon:Outbound Data rate
source="Perfmon:PostilionPostbridgeInterchanges"
My values look something like this: 0.007956853689073186
I am looking for the difference between the two counters and to reduce the number to 3 places behind the decimal point, if possible.
This may work:
| streamstats current=f last(Value) as previous_Value by host counter
| eval delta_Value=round(Value - previous_Value, 3)
If you want the absolute difference:
| eval delta_Value=round(abs(Value - previous_Value), 3)
If you find Splunk's rounded values disagreeing with exact calculations, you can tell Splunk to use exact math to the limits of the operating environment's floating point precision:
| eval delta_Value=exact(round(abs(Value - previous_Value), 3))