Splunk Search

Subtraction of multiple values in same cell

shivaa
Explorer

So I’m pretty new to splunk and I do feel like this should be a lot simpler than I’m making it.

I need two epoch times that are in the same cell to be substracted from each other and I haven’t been able to find anything that can help with it or figure it out myself. I didn't want to use mvexpand because I want the subtraction to be based off of the user

 

My search result looks like this rn:

NameEpoch
UserA

1625037039

1625037045

UserB

1625050381

1625050423

 

Labels (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shivaa 

Can you please try this?

YOUR_SEARCH
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))

 

My Sample Search :

| makeresults | eval _raw="Name	Epoch
UserA	1625037039|1625037045
UserB	1625050381|1625050423"
| multikv forceheader=1
| eval Epoch=split(Epoch,"|")
| table Name Epoch
| rename comment as "Upto Now is sample data only" 
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))


 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

shivaa
Explorer

Hey, thank you for your reply. However I get the following error 😞
-> Error in 'eval' command: Type checking failed. '-' only takes numbers.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shivaa 

Can you please try this?

YOUR_SEARCH
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))

 

My Sample Search :

| makeresults | eval _raw="Name	Epoch
UserA	1625037039|1625037045
UserB	1625050381|1625050423"
| multikv forceheader=1
| eval Epoch=split(Epoch,"|")
| table Name Epoch
| rename comment as "Upto Now is sample data only" 
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))


 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

0 Karma

shivaa
Explorer

worked like a charm, thank you so much! 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval epoch=mvindex(epoch,1)-mvindex(epoch,0)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!