Splunk Search

Getting values from a field and comparing them

mauricio2354
Explorer

I have the following query:

index=source sourcetype=type_example | bin _time span=5m| eval TIME=strftime(_time,"%D:%H:%M") | search (CountryCode="US") | eval transaction_type=case( searchmatch(" eventName=event1 OR eventName=event2") , "Example Info" ) | eval series=ProductDescription."/".transaction_type | where statusCode="1" | chart count as total_count over TIME | tail 2

When I run this query over the past 5 minutes, it gives me a table with two volume results for two time periods, like so:

alt text

I want to assign those two values (211 and 204) to two different variables (count1 and count2), so that I can end up with another result. In the end, I want two more values, count3 = count1 - count2, and count4 = .3 * count1.

Please help, I've been stuck on this forever :disappointed_face:

Thank you!

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Try this

<your query so far with columns TIME and total_count>
| sort - total_count 
| transpose column_name=TIME 
| search TIME=total_count 
| rename "row *" as count* 
| eval count3=count1-count2,count4=round(.3*count1,2)

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Try this

<your query so far with columns TIME and total_count>
| sort - total_count 
| transpose column_name=TIME 
| search TIME=total_count 
| rename "row *" as count* 
| eval count3=count1-count2,count4=round(.3*count1,2)

let me know if this helps!

mauricio2354
Explorer

This helped immensely, thank you so much!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...