Splunk Search

Splunk 640: How to eval the difference between events' values

htkwan
Path Finder

Hello Everybody,
I've a table (w/o the yellow column), as shown below. I want to eval another field (in yellow). It shows the difference between the LatestValue, by Category2, TagName, FiscalDate (number). Pls. advise. Thanks.

alt text

0 Karma

sundareshr
Legend

You could do as @javiergn suggested (set Diff to "" if negative). The risk with that if there are negative Diffs within a tag, you would lose those. Another option would be to use streamstats and group by tag. Like this

your search here | streamstats window=1 current=f first(LatestValue) as NextValue by TagName | eval Diff=LatestValue-NextValue
0 Karma

javiergn
Super Champion

You want to use delta:

your search here
| delta LatestValue as Diff p=1

By the way, make sure your events are sorted first. For instance:

your search here
| sort FiscalDate
| delta LatestValue as Diff p=1

If you need something more granular, such as only sum those where category and tag match then you can use streamstats probably or maybe just sort by FiscalDate, Category2, TagName.

Let me know if the above works for you anyway

0 Karma

htkwan
Path Finder

Hello Javiergn,
It works partially. See below.

alt text

It should be as below.

alt text

0 Karma

javiergn
Super Champion

If you don't want the negative numbers then simply append the following to your search:

| eval Diff = if (Diff < 0, "", Diff)
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...