Splunk Search

Searching where a difference in fields is greater than 1.

tslnmx
Explorer

My log messages have two fields I'd like to search on: engineElapsed and serviceElapsed. I'm interested in looking at all the records where engineElapsed - serviceElapsed > 1.

I'm new to Splunk, and have discovered I can do do something like this:

* | eval time=engineElapsed-serviceElapsed | timechart avg(time) by user

But since I need to see individual log messages, something like this might be more suited -- if it worked, that is:

eval(engineElapsed-serviceElapsed)

Help would be appreciated :slightly_smiling_face:

Tags (1)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Have you tried this?

* | where (engineElapsed - serviceElapsed) > 1

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Have you tried this?

* | where (engineElapsed - serviceElapsed) > 1

tslnmx
Explorer

Well now I just feel silly :). All my searching, and I never found the 'where' command. Thank you!

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...