Splunk Search

Subtract One Field from Another

driva
Path Finder

Hi guys,

I'm having trouble making a simple subtraction (well, I thought it would be simple!). Field1 is a number in string format, Field2 is a count of events. What am I doing wrong?

index=index_name | convert num(Field1) as Field1Total | stats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference

Thanks for your help!

0 Karma

to4kawa
Ultra Champion

Convert

Automatically convert the fields to a number using the best conversion.
convert use conversion .

If you want to modify to number, simply tonumber()

0 Karma

gcusello
Legend

the problem is that after stats command you have only the fields the are in the stats, in your example you have only Field1Total, probably you have to use evenstats command or the values option of stats.

 index=index_name 
| eventstats count(Field2) as Field2Total
| eval Difference=Field2Total - Field1Total 
| table Difference

or

 index=index_name 
| stats count(Field2) as Field2Total values(Field1) as Field1Total
| eval Difference=Field2Total - Field1Total 
| table Difference

Ciao.
Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!