Splunk Search

How to get result for field value difference?

EvansB
Path Finder

Working with this query, I'm hoping to get only results where field values are greater than the other.

 

 

index="index*"
| eval MonthNumber=strftime(_time,"%m") 
| chart eval(round(avg(durationMs), 0)) AS avg_durationMs by properties.url, MonthNumber 
| rename 04 AS "Apr", 05 AS "May"

 

 

 I want to get only results of where Apr values is greater than May by 10

EvansB_1-1653334771444.pngEvansB_1-1653334771444.png

 

Labels (1)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you only want to see results where the "May" number is greater than the "Apr" number then add a where command to the query.

| where May > Apr

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

EvansB
Path Finder

This gives me general results. I need results that are only greater than 10 and beyond. This is for the purpose of setting up an alert when values between May and Apr is greater than 10

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Change the where command to test for the desired difference.

 

| where May > Apr+10

 

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

EvansB
Path Finder

Appreciate your assistance

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Tech Talk Recap   From Chaos to Control: Scaling Splunk Cloud with Infrastructure as Code Managing apps in ...