Splunk Search
Highlighted

Splunk 640: How to eval the difference between events' values

Path Finder

Hello Everybody,
I've a table (w/o the yellow column), as shown below. I want to eval another field (in yellow). It shows the difference between the LatestValue, by Category2, TagName, FiscalDate (number). Pls. advise. Thanks.

alt text

0 Karma
Highlighted

Re: Splunk 640: How to eval the difference between events' values

SplunkTrust
SplunkTrust

You want to use delta:

your search here
| delta LatestValue as Diff p=1

By the way, make sure your events are sorted first. For instance:

your search here
| sort FiscalDate
| delta LatestValue as Diff p=1

If you need something more granular, such as only sum those where category and tag match then you can use streamstats probably or maybe just sort by FiscalDate, Category2, TagName.

Let me know if the above works for you anyway

0 Karma
Highlighted

Re: Splunk 640: How to eval the difference between events' values

Path Finder

Hello Javiergn,
It works partially. See below.

alt text

It should be as below.

alt text

0 Karma
Highlighted

Re: Splunk 640: How to eval the difference between events' values

SplunkTrust
SplunkTrust

If you don't want the negative numbers then simply append the following to your search:

| eval Diff = if (Diff < 0, "", Diff)
0 Karma
Highlighted

Re: Splunk 640: How to eval the difference between events' values

Legend

You could do as @javiergn suggested (set Diff to "" if negative). The risk with that if there are negative Diffs within a tag, you would lose those. Another option would be to use streamstats and group by tag. Like this

your search here | streamstats window=1 current=f first(LatestValue) as NextValue by TagName | eval Diff=LatestValue-NextValue
0 Karma