Difference of fields with the same name in a transaction

[RVDowning]

Given data of the form:
[OPEN PLAN START] Guid=358846c0a0e9, AvailRAM=4555
...
[OPEN PLAN END] Guid=358846c0a0e9, AvailRAM=3211

And if we filter and define transaction by Guid....

"OPEN PLAN" | transaction Guid

is there any way to find the difference between the AvailRam field of 4555 and the AvailRam field of 3211, namely 1344?

[wpreston · Accepted solution]

Sure, this can be done. Us the mvlist option in your transaction command, then do some multivalue field manipulation. I'd also suggest adding startswith and endswith to your transaction to make it a little easier for Splunk to figure out. Try this:

"OPEN PLAN" | transaction Guid startswith="OPEN PLAN START" endswith="OPEN PLAN END" mvlist=AvailRam | eval StartingRam=mvindex(AvailRam, 0) | eval EndingRam=mvindex(AvailRam,-1) | eval RamDiff=StartingRam - EndingRam

RamDiff in the above search is the difference between the Starting and Ending ram amounts for each transaction. This search makes the assumption that you always want to subtract the Ending Ram from the Starting Ram. If this is not the case and you just want the difference between the numbers, you can modify the last eval to use abs()

[clete2]

Fantastic answer. Exactly what I was looking for. Thank you.

[RVDowning]

Ah brilliant, thanks much!