Splunk Search

How do I sum or subtract values depending on 2 distinct fields and chart them?

ADRIANODL
Explorer

Hi folks,

I have a table in the following format:

Date              Buy(qty)  CurrencyBuy      Sell(qty)       CurrencySell    
Jan/2017       500           ETH                     0.2               BTC (meaning I **bought** 500 ETH for 0.2 BTC)
Feb/2017      700           ETH                     0.3               BTC (meaning I **bought** 700 ETH  for 0.3 BTC)
Mar/2017     0.2             BTC                     400             ETH (meaning I **sold** 400 ETH  for 0.2 BTC)

What I'm looking to do is a graph that plots the amount of ETH I have throughout time.

Date Amount 
Jan/2017 500 
Feb/2017 1200 
Mar/2017 800

Thanks for your help folks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...