Splunk Search

How do you subtract values from an appended search?

jephillips
Explorer

I'm trying to run the below searches and get the subtracted value from them. However, the eval command is not giving me a new Difference field. I just get the results of the separate searches.

index=a sourcetype=test start=* end=* | eventstats count as Total1
| append [search index=a sourcetype=test start=* end=* xfer=* | eventstats count as Total2]
| eval Difference=Total1 - Total2

I'd like a chart that with a row for all three values.

Total1        Total2          Difference
10               8                   2
0 Karma
1 Solution

vishaltaneja070
Motivator

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

View solution in original post

Vijeta
Influencer

You can try the below search-

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2
0 Karma

vishaltaneja070
Motivator

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

jephillips
Explorer

That did it! Thanks for the help.

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question and help others find working answers.

0 Karma

vishaltaneja070
Motivator

@jephillips
Great 🙂

Please accept the answer to close the thread.

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...