Splunk Search

subtraction doesn't work for multiple values in one field

almond14
Engager

I managed to create a table that somewhat looks like this:
alt text

However, when I tried to append a new column with the differences between after and before as its value, it just gave me a blank space. I used eval differences=after-before which apparently doesn't work. Is there some other workaround on this? I need to get the list of differences so the end result should look something like below:
alt text

I need to have that column so I can process the average, min, and max difference for each name1, name2, etc.

Thanks!

0 Karma

woodcock
Esteemed Legend

See answer by @sundareshr but also tack on this:

... | stats list(before) AS before list(after) AS after list(diff) AS diff BY names

sundareshr
Legend

Try this

.. | eval z=mvzip(before, after, "@") | mvexpand z | rex field=z "(?<before>.*)@(?<after>.*)" | table names, before, after | eval diff=after-before
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...