Hello Team,
I have a query called:
host="mule1" OR host="mule2" Message="message: Start of Flow CreateUser flow" OR Message="message: All system calls for CREATE user is completed" | stats count by Message
Output:
But here I want in the output the third row should be Failures under Message column and First column minus(-) Second column count in Third column count.
| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column
| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column
I have a similar problem but i have to do it recursively e.g. 2nd row - 1st row, 4th - 3rd row, 6th - 5th and so on and so forth e.g. how can we do it in Splunk ( I am doing a workaround and exporting to Excel and then using = A2-A1, A4-A3). Is it possible to do it in the query itself.
Value
43
65. = 22
24
47. = 23
36
62. = 26
| streamstats count as row current=f last(Value) as previous
| eval row=row%2
| eval diff=if(row=1,Value-previous*row,null())
| fields - previous row
1. This is not recursion
2. This is an old thread with possibly low visibility. Please create a new thread, describe your problem, what data you have, what results you need to raise your chances of getting a meaningful response.
@ITWhisperer thanks for the swift response, i got the exact results.