Splunk Search

How can i do Subtraction cycle?

chengyu
Path Finder

Hi, I have calculate avg values, but i want do subtraction cycle like

values=1,2,5,7,10;sum=25;avg=5

show:

5-1=4
5-2=3
5-5=0
5-7=-2
5-10=-5

How can i do? Thanks.

Tags (2)
0 Karma
1 Solution

fdi01
Motivator
...| eventstats avg (values) as avg | eval your_field_name = avg - values | ...

View solution in original post

0 Karma

chengyu
Path Finder

My splunk search command:
sourcetype=stream:http | streamstats avg(bytes_in) as avg by src_ip | eval minus = avg - bytes_in | table minus,avg,bytes_in,src_ip

0 Karma

chimell
Motivator

Hi

Try this search code

......|stats avg(values) as avg1 , sum(values) as sum1|fillnull value=avg1  avg1|eval subtraction_field=avg1-values |eval avg1."-"values."=".subtraction_field
0 Karma

fdi01
Motivator
...| eventstats avg (values) as avg | eval your_field_name = avg - values | ...
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...