Splunk Search

Difference of fields with the same name in a transaction

RVDowning
Contributor

Given data of the form:
[OPEN PLAN START] Guid=358846c0a0e9, AvailRAM=4555
...
[OPEN PLAN END] Guid=358846c0a0e9, AvailRAM=3211

And if we filter and define transaction by Guid....

"OPEN PLAN" | transaction Guid

is there any way to find the difference between the AvailRam field of 4555 and the AvailRam field of 3211, namely 1344?

Tags (1)
1 Solution

wpreston
Motivator

Sure, this can be done. Us the mvlist option in your transaction command, then do some multivalue field manipulation. I'd also suggest adding startswith and endswith to your transaction to make it a little easier for Splunk to figure out. Try this:

"OPEN PLAN" | transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" mvlist=AvailRam | eval StartingRam=mvindex(AvailRam, 0) | eval EndingRam=mvindex(AvailRam,-1) | eval RamDiff=StartingRam - EndingRam

RamDiff in the above search is the difference between the Starting and Ending ram amounts for each transaction. This search makes the assumption that you always want to subtract the Ending Ram from the Starting Ram. If this is not the case and you just want the difference between the numbers, you can modify the last eval to use abs()

View solution in original post

wpreston
Motivator

Sure, this can be done. Us the mvlist option in your transaction command, then do some multivalue field manipulation. I'd also suggest adding startswith and endswith to your transaction to make it a little easier for Splunk to figure out. Try this:

"OPEN PLAN" | transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" mvlist=AvailRam | eval StartingRam=mvindex(AvailRam, 0) | eval EndingRam=mvindex(AvailRam,-1) | eval RamDiff=StartingRam - EndingRam

RamDiff in the above search is the difference between the Starting and Ending ram amounts for each transaction. This search makes the assumption that you always want to subtract the Ending Ram from the Starting Ram. If this is not the case and you just want the difference between the numbers, you can modify the last eval to use abs()

clete2
Path Finder

Fantastic answer. Exactly what I was looking for. Thank you.

0 Karma

RVDowning
Contributor

Ah brilliant, thanks much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...