Subtraction of multiple values in same cell

[shivaa]

So I’m pretty new to splunk and I do feel like this should be a lot simpler than I’m making it.

I need two epoch times that are in the same cell to be substracted from each other and I haven’t been able to find anything that can help with it or figure it out myself. I didn't want to use mvexpand because I want the subtraction to be based off of the user

My search result looks like this rn:

Name	Epoch
UserA	1625037039 1625037045
UserB	1625050381 1625050423

[shivaa]

Hey, thank you for your reply. However I get the following error 😞
-> Error in 'eval' command: Type checking failed. '-' only takes numbers.

[kamlesh_vaghela · Accepted solution]

@shivaa 

Can you please try this?

YOUR_SEARCH
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))

My Sample Search :

| makeresults | eval _raw="Name	Epoch
UserA	1625037039|1625037045
UserB	1625050381|1625050423"
| multikv forceheader=1
| eval Epoch=split(Epoch,"|")
| table Name Epoch
| rename comment as "Upto Now is sample data only" 
| eval Epoch=tonumber(mvindex(Epoch,1)) - tonumber(mvindex(Epoch,0))

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[shivaa]

worked like a charm, thank you so much! 🙂

[ITWhisperer]

| eval epoch=mvindex(epoch,1)-mvindex(epoch,0)