Splunk Search

How can i do Subtraction cycle?

chengyu
Path Finder

Hi, I have calculate avg values, but i want do subtraction cycle like

values=1,2,5,7,10;sum=25;avg=5

show:

5-1=4
5-2=3
5-5=0
5-7=-2
5-10=-5

How can i do? Thanks.

Tags (2)
0 Karma
1 Solution

fdi01
Motivator
...| eventstats avg (values) as avg | eval your_field_name = avg - values | ...

View solution in original post

0 Karma

chengyu
Path Finder

My splunk search command:
sourcetype=stream:http | streamstats avg(bytes_in) as avg by src_ip | eval minus = avg - bytes_in | table minus,avg,bytes_in,src_ip

0 Karma

chimell
Motivator

Hi

Try this search code

......|stats avg(values) as avg1 , sum(values) as sum1|fillnull value=avg1  avg1|eval subtraction_field=avg1-values |eval avg1."-"values."=".subtraction_field
0 Karma

fdi01
Motivator
...| eventstats avg (values) as avg | eval your_field_name = avg - values | ...
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...