Splunk Search
Highlighted

How do you find the difference between the count of 2 keywords?

Explorer

I have 2 keywords.
"UniSim Job received" and "UniSim Job Run completed successfully".

I want to find the difference between the count of these 2 keywords.

0 Karma
Highlighted

Re: How do you find the difference between the count of 2 keywords?

SplunkTrust
SplunkTrust

@abhishekgandhe

Can you please share some more information?? like, what are your events and what is your expected output.

Thanks

0 Karma
Highlighted

Re: How do you find the difference between the count of 2 keywords?

Communicator

try this, replace "action" with your field name

|stats count(eval(action="UniSim Job received")) as abc count(eval(action="UniSim Job Run completed successfully")) as abcd | eval diff=abc-abcd

View solution in original post

0 Karma