Splunk Search

How do I sum or subtract values depending on 2 distinct fields and chart them?

ADRIANODL
Explorer

Hi folks,

I have a table in the following format:

Date              Buy(qty)  CurrencyBuy      Sell(qty)       CurrencySell    
Jan/2017       500           ETH                     0.2               BTC (meaning I **bought** 500 ETH for 0.2 BTC)
Feb/2017      700           ETH                     0.3               BTC (meaning I **bought** 700 ETH  for 0.3 BTC)
Mar/2017     0.2             BTC                     400             ETH (meaning I **sold** 400 ETH  for 0.2 BTC)

What I'm looking to do is a graph that plots the amount of ETH I have throughout time.

Date Amount 
Jan/2017 500 
Feb/2017 1200 
Mar/2017 800

Thanks for your help folks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...