Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Difference of fields with the same name in a trans...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Given data of the form:
[OPEN PLAN START] Guid=358846c0a0e9, AvailRAM=4555
...
[OPEN PLAN END] Guid=358846c0a0e9, AvailRAM=3211
And if we filter and define transaction by Guid....
"OPEN PLAN" | transaction Guid
is there any way to find the difference between the AvailRam field of 4555 and the AvailRam field of 3211, namely 1344?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure, this can be done. Us the mvlist option in your transaction command, then do some multivalue field manipulation. I'd also suggest adding startswith and endswith to your transaction to make it a little easier for Splunk to figure out. Try this:
"OPEN PLAN" | transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" mvlist=AvailRam | eval StartingRam=mvindex(AvailRam, 0) | eval EndingRam=mvindex(AvailRam,-1) | eval RamDiff=StartingRam - EndingRam
RamDiff in the above search is the difference between the Starting and Ending ram amounts for each transaction. This search makes the assumption that you always want to subtract the Ending Ram from the Starting Ram. If this is not the case and you just want the difference between the numbers, you can modify the last eval to use abs()
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure, this can be done. Us the mvlist option in your transaction command, then do some multivalue field manipulation. I'd also suggest adding startswith and endswith to your transaction to make it a little easier for Splunk to figure out. Try this:
"OPEN PLAN" | transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" mvlist=AvailRam | eval StartingRam=mvindex(AvailRam, 0) | eval EndingRam=mvindex(AvailRam,-1) | eval RamDiff=StartingRam - EndingRam
RamDiff in the above search is the difference between the Starting and Ending ram amounts for each transaction. This search makes the assumption that you always want to subtract the Ending Ram from the Starting Ram. If this is not the case and you just want the difference between the numbers, you can modify the last eval to use abs()
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Fantastic answer. Exactly what I was looking for. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah brilliant, thanks much!
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
