Splunk Search

How to Calculate the difference between two rows of a column?

Splunk_321
Path Finder

I have a splunk query shown below.

 

 

 

basesearch
| stats avg(time) as executionTime by method

 

 

 

which results in table like below

 

 

 

method               executionTime
A                        110.350
B                         90.150

 

 

 

I want to obtain executionTime difference between method A and B in a table result

A-B = 20.20

Please help me with splunk query to get the same.

Thanks in advance!

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Splunk_321,

you have to put them in the same row, something like this:

basesearch
| stats 
   avg(eval(if(method="A"),time,0)) as executionTime_A
   avg(eval(if(method="B"),time,0)) as executionTime_B
| eval diff=executionTime_B-executionTime_A

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...