How to find the difference between the max value and the min value in the multi-value field combined by transaction?

[Msugiyama]

I want to find the difference between the maximum value and the minimum value in the multi-value field that has been lumped together with the transaction command.

Specifically, group the web access logs by ID, and then
I would like to find the time that the ID was operating from login to operation to logout.

Do you have an idea for SPL?

[Msugiyama]

|makeresults
|eval txnid=1234, value=40
|append [|makeresults |eval txnid=1234, value=20]
|transaction txnid |eval diff = abs(tonumber(mvindex(value, 0)) - tonumber(mvindex(value, 1)))
|table diff

@venky1544 
This is it!
Thank you so much. I solved it with this SPL.
Best regard.

@richgalloway 
Thank you too.
I will read the page that guided me.

[venky1544]

Hi @Msugiyama 

if the solutions has helped you  can you please accept it as solution as it might help others 

thanks

Njoy splunking

venky1544

[venky1544]

hi @Msugiyama 

if you could share some sample data thats would be great for more people to pitch in 

and are you asking two different questions here 

about the diff of the max and min value clubbed together by transaction command you can try something like this 

|makeresults |eval txnid=1234, value=40 |append [|makeresults |eval txnid=1234, value=20] |transaction txnid |eval diff = abs(tonumber(mvindex(value, 0)) - tonumber(mvindex(value, 1))) |table diff

and about the group the web access logs by ID you can use the stats command

but would appreciate if you could throw more sample data 

if the reply helps karma points are appreciated 

[richgalloway]

Can you tell us more about this use case?  What is the query?  What type of data are you comparing?

Check out the mvstats app (https://splunkbase.splunk.com/app/5198/) for functions that work with multivalue fields.