Splunk Search

How to Make operations between two columns

nalagito
Observer

Hello, I have this query:

 

 

| mstats avg(_value) as packets WHERE index=metrics_index sourcetype=network_metrics (metric_name=*.out) ((metric_name="InterfaceEthernetA.*" OR metric_name="InterfaceEthernetB.*") AND (host="hostA" OR host="hostB")) span=1m by metric_name,host 
| rex field=metric_name ".*InterfaceEthernet(?<mn>\d_\d*)"
| eval kbits=packets*8/1000
| timechart span=30m sum(kbits) by mn

 

 

 

It returns this results:

 

img.jpeg

 

From those results, I would like to make operations generating another column with those results...

 

For example: (ColumnA - ColumnB) / ColumnA * 100

 

How could I do that?

Labels (3)
0 Karma

gcusello
Legend

Hi @nalagito,

if the values of ColumnA and ColumnB are fixed, you can use the eval command to make the calculation you need.

If instead they aren't fixed, is much more complicated.

Ciao.

Giuseppe

0 Karma

nalagito
Observer

@gcusello 

Could you please give me an example? What do you mean with "fixed"?

0 Karma

gcusello
Legend

Hi @nalagito,

if the values of mn are always:

  • my_mn1,
  • my_mn2.

in this case you can make operations using my_mn1 and my_mn2 as column name.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...