Splunk Search

## Perform SUM and DIFF on multiple fields Explorer

Hi,

I'am sending some events each minute to Splunk :

 TIME ID IN OUT 08:00 A 1 0 08:00 B 0 0 08:01 A 2 1 08:01 B 2 2 08:01 C 4 0 08:02 A 3 3 08:02 B 3 2 08:03 A 6 4 08:03 B 3 3 08:04 A 6 4 08:04 B 3 3 08:04 C 4 2 08:05 A 6 4 08:05 B 3 3 08:05 C 4 2

What i'am trying to get as a result is :

 TIME SUMIN - PREVIOUS_SUMIN SUMOUT - PREVIOUS_SUMOUT 08:00 =1+0 = 1 =0+0 = 0 08:01 =2+2+4 - (1+0) = 7 =1+2+0 - (0+0) = 3 08:02 =3+3 - (2+2+4) = -2 =3+2 - (1+2+0) = 2 08:03 =6+3 - (3+3) = 3 =4+3 - (3+2) = 2 08:04 =6+3+4 - (6+3) = 4 =4+3+2 - (4+3) = 2 08:05 =6+3+4 - (6+3+4) = 0 =4+3+2 - (4+3+2) = 0

After that i need to plot the two columns using a timechart by TIME

Any hints are welcome.

Thank you guys

Labels (2)

• ### timechart

Tags (4)
1 Solution Legend
``````| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| fillnull value=0 previous_in previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change`````` Legend
``````| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change`````` Explorer

Thank you @ITWhisperer  for your feedback.

I have tried your hint but i'am not getting the first line as expected : Tags (1) Legend
``````| bin span=1m time
| stats sum(in) as in sum(out) as out by time
| streamstats window=1 current=f values(in) as previous_in values(out) as previous_out
| fillnull value=0 previous_in previous_out
| eval in_change=in-previous_in
| eval out_change=out-previous_out
| table time in_change out_change`````` Register for .conf21 Now! Go Vegas or Go Virtual!

### How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20. Learn More or Register Now >

Get Updates on the Splunk Community!