Splunk Search

Dashboard

uagraw01
Motivator

I want difference between 155 and 132, how can i do with the Spl.

 

IMG_20201103_194436.jpg

0 Karma
1 Solution

renjith_nair
Legend

Try adding this to your search

Your search
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

Run anywhere search

|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

 

OR

Your search
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week
|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Try adding this to your search

Your search
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

Run anywhere search

|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that
|eval diff=this-that

 

OR

Your search
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week
|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status]
|eval {Week_Status}=Total_host
|stats values(*) as *
|eval diff=last_week-this_week

 

---
What goes around comes around. If it helps, hit it with Karma 🙂

uagraw01
Motivator

@renjith_nair  Thanks for your response. I need to add list of difference server also in my search how can i add ? Please help

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...