Splunk Search

How to create difference of two values

Contributor

Q1: How can I get c4 where c4 will always be the difference of values in c3 against max of c2 - min of c2

For example: Here c4 for A = 677-76

Please guide.

c    c2   c3
A   1   76
A   2   7
A   3   6
A   4   677
B   1   65
B   2   675
B   3   90
B   4   78
C   1   121
C   2   56
C   3   54
C   4   67
D   1   56
D   2   6
D   3   5
D   4   657
Tags (3)
0 Karma
1 Solution

Influencer

@reverse

 <your query>| sort c c2
  | stats first(c3) as first, last(c3) as last by c 
  | eval c4=last - first

View solution in original post

0 Karma

Influencer

@reverse

 <your query>| sort c c2
  | stats first(c3) as first, last(c3) as last by c 
  | eval c4=last - first

View solution in original post

0 Karma

Contributor

This worked but i had to add eventstats. .. was getting blank with stats

0 Karma

Influencer

Good to know. Thanks

0 Karma

Contributor
0 Karma

Splunk Employee
Splunk Employee

Try something like this:

index="yourindex" sourcetype="yoursourcetype" 
| stats max(c3) as max min(c3) as min by c 
| eval c4=max-min
0 Karma

Contributor

Please see the example

0 Karma

Splunk Employee
Splunk Employee

Is this what you were looking for?

index="yourindex" sourcetype="yoursourcetype" 
| eventstats min(c3) as min max(c3) as max by c 
| eval c4=max-min 
| table c c2 c3 c4 
| sort c c2

Contributor

This is not producing the intended results

0 Karma

Contributor

@Vijeta please guide.

0 Karma

Influencer

@reverse try using delta command and see if that works.

0 Karma

Contributor

Tried that .. it is continuing for all rows .. i want it by c1.. delta is not taking by clause

0 Karma

Influencer

@reverse ok I see you changed the question. Try below

<your query>
 | stats max(c3) as max, min(c3) as min by c 
 | eval c4=max-min
0 Karma

Contributor

Not producing the intended result..

0 Karma

Contributor

I need the difference of c2 against c3 values as mentioned in the example

0 Karma

Contributor

Could you please post an example.. dont know that command..thank you

0 Karma