Splunk Search

diff between numbers

indeed_2000
Motivator

Hi
need to compare total numbers if they are different show table that present them
23:57:05.253 app module: PACK: Total:[1010000] from server1 Total:[C000001010000]
23:57:05.254 app module: PACK: Total:[1010000] from server1 Total:[C000001000000]

diff=second total - first total

expected output:
Time                                 diff
23:57:05.254        10000

any idea?

Thanks,

0 Karma
1 Solution

indeed_2000
Motivator

after workaround do this with eval command.

index="myindex"

| eval diff=(total2 - total1)

| table _time diff 

View solution in original post

0 Karma

indeed_2000
Motivator

after workaround do this with eval command.

index="myindex"

| eval diff=(total2 - total1)

| table _time diff 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...