Splunk Search

I have to subtract between 2 alternate rows. Like Row2-1,Row 4-3 . Not the difference between the consecutive rows. I used "Diff" but it gives diff b/w each row. Please suggest.

BTCM
Engager

TXName Period Value diffValue
tx1 Period 1 25

tx1 Period 2 14 -11
tx2 Period 1 12

tx2 Period 2 20 8

I need to calculate the "value" difference of tx1& tx2 respect to Period.

Tags (2)
0 Karma
1 Solution

javiergn
Super Champion

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

View solution in original post

0 Karma

javiergn
Super Champion

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...