would like to know how to get subtraction of field value in two different events

[Ahmedkhalil]

would like to know how to get subtraction of field value in two different events
i mean i have event A with field sum = 15
and event B with field sum = 20
i would like to create new field called diff that contain value = field of event B - field of event A

thanks in advance

[Ahmedkhalil]

ok it's good start how can i do this task at index time not search time

[martin_mueller]

You cannot do maths at index time, you're limited to regular expressions.

[Ahmedkhalil]

ok but problem is that i will use this field many times in dashboards and it's alot of data So execute this search command each time will make reports and dashboard slow

[pradeepkumarg · Accepted solution]

What you are looking for is delta command

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Delta

[MuS]

Hi Ahmedkhalil,

you can use streamstats to achieve it. Using streamstats like this:

your base search here| streamstats current=f last(sum) AS last | eval diff=sum-last | table event sum diff

Hope this helps ...

cheers, MuS

[Ahmedkhalil]

i would like to get difference between two fields not summation
and also this events is transaction
so i need to get difference between events in same transaction

[MuS]

Another addition; if this is really in a Splunk transaction event, it will not work with delta nor streamstats. Both commands do their thing event based:

 For each event where field is a number, the delta command computes the difference, in search order, between the field value for the event and the field value for the previous event. The delta command writes this difference into newfield

The same is with streamstats ....

[Ahmedkhalil]

but below example from search referance delta examples and contain same example that i can use
sourcetype=access_* | transaction JSESSIONID clientip startswith="view" endswith="purchase" | delta _time AS timeDelta p=1 | eval timeDelta=abs(timeDelta) | eval timeDelta=tostring(timeDelta,"duration")

[MuS]

Yes, if your after transaction event has a single value field which can be used with delta it will work....But you have a transaction with a multi value field called sum and this cannot be used in delta .....

[MuS]

Sorry my bad, I'm still a bit sleepy 😉 BTW your question states it's two events and not one transaction event.