Splunk Enterprise

How to subtract or minus the values

phanichintha
Path Finder

Hello Team,

I have a query called:
host="mule1" OR host="mule2" Message="message: Start of Flow CreateUser flow" OR Message="message: All system calls for CREATE user is completed" | stats count by Message

Output:

phanichintha_0-1624883529929.png

But here I want in the output the third row should be Failures under Message column and First column minus(-) Second column count in Third column count.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column
0 Karma

amitshrigoel
Explorer

I have a similar problem but i have to do it recursively e.g. 2nd row - 1st row, 4th - 3rd row, 6th - 5th and so on and so forth e.g. how can we do it in Splunk ( I am doing a workaround and exporting to Excel and then using = A2-A1, A4-A3). Is it possible to do it in the query itself.

Value

43

65.     = 22

24

47.    = 23

36

62. = 26

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row current=f last(Value) as previous
| eval row=row%2
| eval diff=if(row=1,Value-previous*row,null())
| fields - previous row

PickleRick
SplunkTrust
SplunkTrust

1. This is not recursion

2. This is an old thread with possibly low visibility. Please create a new thread, describe your problem, what data you have, what results you need to raise your chances of getting a meaningful response.

0 Karma

phanichintha
Path Finder

@ITWhisperer thanks for the swift response, i got the exact results.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...