I have two very simple searches and I need to be able to get the difference. This is insanely hard for something that is so simple.
search index="first-app" sourcetype="first-app_application_log"
AND "eventType=IMPORTANT_CREATE_EVENT" | stats count
^ this result is 150
search index="second-app" sourcetype="second-app_application_log"
AND "eventType=IMPORTANT_CANCEL_EVENT" | stats count
^ this result is 5
I'm trying to figure out how to simply do the 150 - 5 to get 145. I've tried `set diff` `eval` a bunch of different ways with no luck. I'm going nuts.
Any help would be greatly appreciated!
Hi @Fo,
please try something like this:
(index="first-app" sourcetype="first-app_application_log" "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
count(eval(index="first-app")) AS "first_app"
count(eval(index="second-app")) AS "second_app"
| eval diff="first_app"-"second_app"
| table diff
One additional hint: don't use minus char in field names because Splunk knows it as the minus sign, use underscore (_).
Ciao.
Giuseppe
Hi @Fo ,
as hinted by @ITWhisperer it was a mistyping for this reason I hinted to avoid the minus char!
(index="first-app" sourcetype="first-app_application_log" "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
count(eval(index="first-app")) AS "first_app"
count(eval(index="second-app")) AS "second_app"
| eval diff=first_app-second_app
| table diff
Ciao.
Giuseppe
Correction to @gcusello 's suggestion - when you quote field names on the righthand side of an evaluation, you need to use single quotes not double quotes (otherwise, Splunk treats them as strings and you can't subtract on string from another as they are not numeric data types)
(index="first-app" sourcetype="first-app_application_log" "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
count(eval(index="first-app")) AS "first_app"
count(eval(index="second-app")) AS "second_app"
| eval diff='first_app'-'second_app'
| table diff