Splunk Search

Simple subtraction between two searches

Fo
Engager

I have two very simple searches and I need to be able to get the difference. This is insanely hard for something that is so simple. 

search index="first-app" sourcetype="first-app_application_log"
AND "eventType=IMPORTANT_CREATE_EVENT" | stats count

^ this result is 150

search index="second-app" sourcetype="second-app_application_log"
AND "eventType=IMPORTANT_CANCEL_EVENT" | stats count

^ this result is 5

I'm trying to figure out how to simply do the 150 - 5 to get 145. I've tried `set diff` `eval` a bunch of different ways with no luck. I'm going nuts.

Any help would be greatly appreciated!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Fo,

please try something like this:

(index="first-app" sourcetype="first-app_application_log"  "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
   count(eval(index="first-app")) AS "first_app"
   count(eval(index="second-app")) AS "second_app"
| eval diff="first_app"-"second_app"
| table diff

One additional hint: don't use minus char in field names because Splunk knows it as the minus sign, use underscore (_).

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Fo ,

as hinted by @ITWhisperer it was a mistyping for this reason I hinted to avoid the minus char!

(index="first-app" sourcetype="first-app_application_log"  "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
   count(eval(index="first-app")) AS "first_app"
   count(eval(index="second-app")) AS "second_app"
| eval diff=first_app-second_app
| table diff

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Correction to @gcusello 's suggestion - when you quote field names on the righthand side of an evaluation, you need to use single quotes not double quotes (otherwise, Splunk treats them as strings and you can't subtract on string from another as they are not numeric data types)

(index="first-app" sourcetype="first-app_application_log"  "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
   count(eval(index="first-app")) AS "first_app"
   count(eval(index="second-app")) AS "second_app"
| eval diff='first_app'-'second_app'
| table diff

 

Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...