Splunk Search

How do i subtract values from the same field and table results by another field in this case Field B

Explorer

How do i subtract values from the same field and table results by another field in this case Field B

subtract 400 - 200 for value 1
and 300 - 200 for value 2

FieldA FieldB FieldC
200 value1 may-2-2018
300 value2 June-2-2018
400 value1 may-2-2018
200 value2 Jun2-2-2018

0 Karma
1 Solution

Great, then I think this should do it for you:

base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC

View solution in original post

0 Karma

Explorer

i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB

Thanks elliotproebstel, i got a clue when you mentioned Max and Min

0 Karma

Motivator

hey Bentash,

Please accept the answer by elliotproebstel to close the question.

0 Karma

Glad to help!

0 Karma

Great, then I think this should do it for you:

base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC

View solution in original post

0 Karma

How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.

0 Karma

Explorer

i correct 300-300 its a type.. and i am determining the results for Value1 and 2 because i want to get the difference between those two result sets since that are coming from different dates

0 Karma

Explorer

i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB

Thanks elliotproebstel, i got a clue when you mentioned Max and Min

0 Karma