Splunk Search

How can I subtract three values from Json?

gcescatto
New Member

Hi!
I have a Json like this:
{"LicenseNum":62,
"Status":"Registered"}
and the Status can differ from three types: Registered, Disconnected and Dropped.
alt text

Based on this chart, I need to build a new one with the following mathematical equation: number of Registered - number of Disconnected - number of Dropped.
Could somebody please help me?
I've already tried to use the stats and eval function, but I probably did something really wrong.

Thank you in advance (:

Tags (3)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Try adding this

... | eval Remaining = Registered - Disconnected - Dropped

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try adding this

... | eval Remaining = Registered - Disconnected - Dropped

0 Karma

gcescatto
New Member

I've already tried it. I'm using the following query:

eval License=(Registered - Disconnected - Dropped) | chart max(LicenseNum) by DateTime, License

But I keep getting as result just "Registered - Disconnected"

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...