How to extract a decimal value, find the difference between them, and generate a report by the hour?

[gopalreddyv]

Below is the Splunk string and I want to find the difference between Original cost:: ** and **Validation Cost::, please help me out

5/30/18
12:04:00.000 PM 
05/30/2018 12:04:00 PM
LogName=Bev5SOA
SourceName=Bev5SOA
EventCode=0
EventType=2
Type=Error
ComputerName=ip-0A000129
TaskCategory=%1
OpCode=Info
RecordNumber=32156
Keywords=Classic
Message=2018-05-30 12:04:00,607 [94] ERROR Bev5 [(null)] - CopyAvailabilityToValuation::TotalCost ValuationFailed for ValuationRequest:: {"ProductType":1,"SearchIdentifier":"00000000-0000-0000-0000-000000000000","Channel":1,"EdiCode":"eaff3fcc-b036-4173-aea1-a9328186460d","Contract":"def37efd-edca-41ac-9b3d-80348aee261b","IncomingContract":"false==2 days of more|No Charge;Less than 2 days|1 night at the booked board basis;Non Refundable|100.00%==1 night at the booked board basis","ArrivalDate":"2018-10-13T00:00:00","DepartureDate":"2018-10-20T00:00:00","Resort":"3451e86f-fa28-425e-ad26-2e271f715db3","BoardTypeCode":"BB","RoomTypeCode":"6545f3c9-a009-48c1-851e-9dcb8c2dbf02","Rooms":1,"Adults":3,"Children":0,"AgeChild1":6,"AgeChild2":6,"AgeChild3":6,"AgeChild4":6,"EdiSource":"A","Pax1Surname":"","Pax2Surname":"","Pax3Surname":"","Pax4Surname":"","Child1Surname":"","Child2Surname":"","Child3Surname":"","Child4Surname":"","Origin":"","Direction":0,"RoomId":1,"RoomDescription":"Triple Room with Balcony or Terrace","BoardDescription":"BED & BREAKFAST","RoomNumber":1,"MarketCountryCode":"GB","LongDescription":"","IsBot":false,"ParentDestinationId":null,"DestinationId":"3451e86f-fa28-425e-ad26-2e271f715db3"} Original cost:: 552.72 Validation Cost:: 614.11
 CopyAvailabilityToValuation
  Source - ip-0A000129
  Collapse

[FrankVl]

First step: extract those fields (assuming those are not extracted already):

| rex "Original\s+cost::\s+(?<OriginalCost>[\d\.]+)\s+Validation\s+Cost::\s+(?<ValidationCost>[\d\.]+)"

Next step: calculate the difference:

| eval difference = ValidationCost-OriginalCost

Once you have that extracted and calculated, you can report on in however you want (not entirely sure what you mean by "report by an hour").