Splunk Search

How do you subtract values from an appended search?

jephillips
Explorer

I'm trying to run the below searches and get the subtracted value from them. However, the eval command is not giving me a new Difference field. I just get the results of the separate searches.

index=a sourcetype=test start=* end=* | eventstats count as Total1
| append [search index=a sourcetype=test start=* end=* xfer=* | eventstats count as Total2]
| eval Difference=Total1 - Total2

I'd like a chart that with a row for all three values.

Total1        Total2          Difference
10               8                   2
0 Karma
1 Solution

vishaltaneja070
Motivator

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

View solution in original post

Vijeta
Influencer

You can try the below search-

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2
0 Karma

vishaltaneja070
Motivator

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

jephillips
Explorer

That did it! Thanks for the help.

0 Karma

woodcock
Esteemed Legend

Be sure to click Accept to close the question and help others find working answers.

0 Karma

vishaltaneja070
Motivator

@jephillips
Great 🙂

Please accept the answer to close the thread.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...