Splunk Search

How do you subtract values from an appended search?

jephillips
Explorer

I'm trying to run the below searches and get the subtracted value from them. However, the eval command is not giving me a new Difference field. I just get the results of the separate searches.

index=a sourcetype=test start=* end=* | eventstats count as Total1
| append [search index=a sourcetype=test start=* end=* xfer=* | eventstats count as Total2]
| eval Difference=Total1 - Total2

I'd like a chart that with a row for all three values.

Total1        Total2          Difference
10               8                   2
0 Karma
1 Solution

vishaltaneja070
Motivator

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

View solution in original post

Vijeta
Influencer

You can try the below search-

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2
0 Karma

vishaltaneja070
Motivator

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

jephillips
Explorer

That did it! Thanks for the help.

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question and help others find working answers.

0 Karma

vishaltaneja070
Motivator

@jephillips
Great 🙂

Please accept the answer to close the thread.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...