Splunk Search

How to Make operations between two columns

nalagito
Observer

Hello, I have this query:

 

 

| mstats avg(_value) as packets WHERE index=metrics_index sourcetype=network_metrics (metric_name=*.out) ((metric_name="InterfaceEthernetA.*" OR metric_name="InterfaceEthernetB.*") AND (host="hostA" OR host="hostB")) span=1m by metric_name,host 
| rex field=metric_name ".*InterfaceEthernet(?<mn>\d_\d*)"
| eval kbits=packets*8/1000
| timechart span=30m sum(kbits) by mn

 

 

 

It returns this results:

 

img.jpeg

 

From those results, I would like to make operations generating another column with those results...

 

For example: (ColumnA - ColumnB) / ColumnA * 100

 

How could I do that?

Labels (3)
0 Karma

gcusello
Legend

Hi @nalagito,

if the values of ColumnA and ColumnB are fixed, you can use the eval command to make the calculation you need.

If instead they aren't fixed, is much more complicated.

Ciao.

Giuseppe

0 Karma

nalagito
Observer

@gcusello 

Could you please give me an example? What do you mean with "fixed"?

0 Karma

gcusello
Legend

Hi @nalagito,

if the values of mn are always:

  • my_mn1,
  • my_mn2.

in this case you can make operations using my_mn1 and my_mn2 as column name.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...