Splunk Search
Highlighted

How to get diff count and show field and result of diff

New Member

Hello Splunkers,

I have a trouble with the result, example i have some data log

Goat | alive
Goat | dead
Goat | alive

Rabit | alive
Rabit | dead

my trouble is , how to get data count alive or dead , example a Goat (alive =2 , dead = 1) diff = alive - dead (1) , and Rabit(alive=1 , dead=1) diff = alive - dead (0), i want to create table of result
Animal | alive | dead | diff
Goat | 2 | 1 | 1
Rabit | 1 | 1 | 0

please help me for the query, thank you splunkers

Tags (2)
0 Karma
Highlighted

Re: How to get diff count and show field and result of diff

Influencer

hi @mockingj,

Try this:

| makeresults 
| eval _raw="_raw
Goat | alive
Goat | dead
Goat | alive
Rabit | alive
Rabit | dead" 
| multikv forceheader=1 
| rex "(?<Animal>\w+)\s\|\s(?<status>\w+)" 
| stats count(eval(status="alive")) as alive, count(eval(status="dead")) as dead by Animal 
| eval diff=alive-dead
0 Karma
Highlighted

Re: How to get diff count and show field and result of diff

New Member

thanks you for your answer

0 Karma
Highlighted

Re: How to get diff count and show field and result of diff

SplunkTrust
SplunkTrust

See if this helps.

... | stats count(eval(state="alive")) as AliveCount, count(eval(state="dead")) as DeadCount by Animal
| eval diff = AliveCount - DeadCount
| table Animal, AliveCount, DeadCount, diff
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Highlighted

Re: How to get diff count and show field and result of diff

New Member

wonderful answer :)) , the best word by Animal , thank you very much

0 Karma