Searching where a difference in fields is greater than 1.

[tslnmx]

My log messages have two fields I'd like to search on: engineElapsed and serviceElapsed. I'm interested in looking at all the records where engineElapsed - serviceElapsed > 1.

I'm new to Splunk, and have discovered I can do do something like this:

* | eval time=engineElapsed-serviceElapsed | timechart avg(time) by user

But since I need to see individual log messages, something like this might be more suited -- if it worked, that is:

eval(engineElapsed-serviceElapsed)

Help would be appreciated 🙂

[dwaddle · Accepted solution]

Have you tried this?

* | where (engineElapsed - serviceElapsed) > 1

[tslnmx]

Well now I just feel silly :). All my searching, and I never found the 'where' command. Thank you!