Splunk Search

## Perform SUM and DIFF on multiple fields

Explorer

Hi,

I'am sending some events each minute to Splunk :

 TIME ID IN OUT 08:00 A 1 0 08:00 B 0 0 08:01 A 2 1 08:01 B 2 2 08:01 C 4 0 08:02 A 3 3 08:02 B 3 2 08:03 A 6 4 08:03 B 3 3 08:04 A 6 4 08:04 B 3 3 08:04 C 4 2 08:05 A 6 4 08:05 B 3 3 08:05 C 4 2

What i'am trying to get as a result is :

 TIME SUMIN - PREVIOUS_SUMIN SUMOUT - PREVIOUS_SUMOUT 08:00 =1+0 = 1 =0+0 = 0 08:01 =2+2+4 - (1+0) = 7 =1+2+0 - (0+0) = 3 08:02 =3+3 - (2+2+4) = -2 =3+2 - (1+2+0) = 2 08:03 =6+3 - (3+3) = 3 =4+3 - (3+2) = 2 08:04 =6+3+4 - (6+3) = 4 =4+3+2 - (4+3) = 2 08:05 =6+3+4 - (6+3+4) = 0 =4+3+2 - (4+3+2) = 0

After that i need to plot the two columns using a timechart by TIME

Any hints are welcome.

Thank you guys

Labels (2)

• ### timechart

Tags (4)
1 Solution
SplunkTrust
``````| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| fillnull value=0 previous_in previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change``````
SplunkTrust
``````| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change``````
Explorer

Thank you @ITWhisperer  for your feedback.

I have tried your hint but i'am not getting the first line as expected :

Tags (1)
SplunkTrust
``````| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| fillnull value=0 previous_in previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change``````
Get Updates on the Splunk Community!

#### Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

#### Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

#### User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...