Difference between two perfmon counters from the same source to identify bottleneck

[rholm01]

Counter 1 - Perfmon: Inbound Data rate

Counter 2  - Perfmon:Outbound Data rate

source="Perfmon:PostilionPostbridgeInterchanges"

My values look something like this:  0.007956853689073186

I am looking for the difference between the two counters and to reduce the number to 3 places behind the decimal point, if possible.

[tscroggins]

@rholm01 

This may work:

| streamstats current=f last(Value) as previous_Value by host counter
| eval delta_Value=round(Value - previous_Value, 3)

If you want the absolute difference:

| eval delta_Value=round(abs(Value - previous_Value), 3)

If you find Splunk's rounded values disagreeing with exact calculations, you can tell Splunk to use exact math to the limits of the operating environment's floating point precision:

| eval delta_Value=exact(round(abs(Value - previous_Value), 3))