Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How do i subtract values from the same field a...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do i subtract values from the same field and table results by another field in this case Field B
subtract 400 - 200 for value 1
and 300 - 200 for value 2
FieldA FieldB FieldC
200 value1 may-2-2018
300 value2 June-2-2018
400 value1 may-2-2018
200 value2 Jun2-2-2018
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great, then I think this should do it for you:
base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB
Thanks elliotproebstel, i got a clue when you mentioned Max and Min
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey Bentash,
Please accept the answer by elliotproebstel to close the question.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Glad to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great, then I think this should do it for you:
base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i correct 300-300 its a type.. and i am determining the results for Value1 and 2 because i want to get the difference between those two result sets since that are coming from different dates
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB
Thanks elliotproebstel, i got a clue when you mentioned Max and Min
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
