How to subtract or minus the values

[phanichintha]

Hello Team,

I have a query called:
host="mule1" OR host="mule2" Message="message: Start of Flow CreateUser flow" OR Message="message: All system calls for CREATE user is completed" | stats count by Message

Output:

But here I want in the output the third row should be Failures under Message column and First column minus(-) Second column count in Third column count.

[ITWhisperer · Accepted solution]

| transpose 0 header_field=message
| eval Failures='message: Start of Flow CreateUser flow'-'message: All system calls for CREATE user is completed'
| transpose 0 column_name=message header_field=column

[amitshrigoel]

I have a similar problem but i have to do it recursively e.g. 2nd row - 1st row, 4th - 3rd row, 6th - 5th and so on and so forth e.g. how can we do it in Splunk ( I am doing a workaround and exporting to Excel and then using = A2-A1, A4-A3). Is it possible to do it in the query itself.

Value

43

65.     = 22

24

47.    = 23

36

62. = 26

[ITWhisperer]

| streamstats count as row current=f last(Value) as previous
| eval row=row%2
| eval diff=if(row=1,Value-previous*row,null())
| fields - previous row

[PickleRick]

1. This is not recursion

2. This is an old thread with possibly low visibility. Please create a new thread, describe your problem, what data you have, what results you need to raise your chances of getting a meaningful response.

[phanichintha]

@ITWhisperer thanks for the swift response, i got the exact results.