Splunk Search

Splunk 640: How to eval the difference between events' values

htkwan
Path Finder

Hello Everybody,
I've a table (w/o the yellow column), as shown below. I want to eval another field (in yellow). It shows the difference between the LatestValue, by Category2, TagName, FiscalDate (number). Pls. advise. Thanks.

alt text

0 Karma

sundareshr
Legend

You could do as @javiergn suggested (set Diff to "" if negative). The risk with that if there are negative Diffs within a tag, you would lose those. Another option would be to use streamstats and group by tag. Like this

your search here | streamstats window=1 current=f first(LatestValue) as NextValue by TagName | eval Diff=LatestValue-NextValue
0 Karma

javiergn
SplunkTrust
SplunkTrust

You want to use delta:

your search here
| delta LatestValue as Diff p=1

By the way, make sure your events are sorted first. For instance:

your search here
| sort FiscalDate
| delta LatestValue as Diff p=1

If you need something more granular, such as only sum those where category and tag match then you can use streamstats probably or maybe just sort by FiscalDate, Category2, TagName.

Let me know if the above works for you anyway

0 Karma

htkwan
Path Finder

Hello Javiergn,
It works partially. See below.

alt text

It should be as below.

alt text

0 Karma

javiergn
SplunkTrust
SplunkTrust

If you don't want the negative numbers then simply append the following to your search:

| eval Diff = if (Diff < 0, "", Diff)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...