Solved: Re: difference of two counts - Splunk Community

Splunk Search

chart count(IN), count(OUT), count(EXP) by SERVER

I also want to include the calculated value of count(IN)-count(OUT)-count(EXP) on the column chart. How can I include that calculation?

Thanks!

1 Solution

Solution

I can't try it right now but it probably looks like this:

<search> | stats count(IN) as inCount, count(OUT) as outCount, count(EXP) as expCount by SERVER | eval calcField = inCount - outCount - expCount | chart inCount, outCount, expCount, calcField by SERVER

View solution in original post

Solution

I can't try it right now but it probably looks like this:

<search> | stats count(IN) as inCount, count(OUT) as outCount, count(EXP) as expCount by SERVER | eval calcField = inCount - outCount - expCount | chart inCount, outCount, expCount, calcField by SERVER

Thanks. That way works!

Get Updates on the Splunk Community!

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Splunk Cloud Application Management in Terraform

Now On-Demand We’re diving into how you can bring Infrastructure as Code (IaC) principles to your Splunk ...

What's New in Splunk Enterprise Security (ES) 8.6

Purpose-Built AI Agents for the Agentic SOC Splunk Enterprise Security 8.6 expands AI in Security with ...