Splunk Search

How to substract values from two different fields in a search?

Builder

Hi all.

I have a FIELDX with values like:

VALUE1 200
VALUE2 120
VALUE3 156

Also, I have another field FIELDY, values:

VALUE1 120
VALUE2 76
VALUE3 54

I want to show in a table a new field showing the difference between FIELDX and FIELDY per VALUE. I mean:

FIELDZ

VALUE1 80
VALUE2 44
VALUE3 102

I tried with a simple ... | eval FIELDZ=FIELDX-FIELDY, but that didn't work.

How I can do this?

Thanks!

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Is it possible that there is a single event which contain two fields, each with multiple values? In this scenario, the fields are the equivalent of arrays which hold a list of values and lists cannot be added together. Simply put: the operation needs to use a single value against a single value at a time.

alt text

Do you notice the eval statement at the end of the search?

If this were the case, it will be necessary to break down the multi-value fields using some transformation commands. For the example above, the following works.

alt text

As other Splunkers point out above, it will be important to understand how the data is being presented. From there, the transformation can happen in number of ways. This is just an example based on intuituion... but it may not reflect your reality.

I hope this helps,

-gc

View solution in original post

Splunk Employee
Splunk Employee

Is it possible that there is a single event which contain two fields, each with multiple values? In this scenario, the fields are the equivalent of arrays which hold a list of values and lists cannot be added together. Simply put: the operation needs to use a single value against a single value at a time.

alt text

Do you notice the eval statement at the end of the search?

If this were the case, it will be necessary to break down the multi-value fields using some transformation commands. For the example above, the following works.

alt text

As other Splunkers point out above, it will be important to understand how the data is being presented. From there, the transformation can happen in number of ways. This is just an example based on intuituion... but it may not reflect your reality.

I hope this helps,

-gc

View solution in original post

Builder

Ive never done it, but you may try
|eval fieldx=(fieldX - fieldy)
I know you tried something similar, but I recall that functions usually need to be enclosed to work.

0 Karma

Contributor

What is the format of the event? JSON? Posting the event might be helpful!

0 Karma

SplunkTrust
SplunkTrust

Ideally based on the example the above should work. Have you tried printing table FIELDX FIELDY FIELDZ? Are the two fields FIELDX & FIELDY numeric?
Please provide Splunk search query and sample FIELDX and FIELDY.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma