Splunk Search

How do I sum or subtract values depending on 2 distinct fields and chart them?

ADRIANODL
Explorer

Hi folks,

I have a table in the following format:

Date              Buy(qty)  CurrencyBuy      Sell(qty)       CurrencySell    
Jan/2017       500           ETH                     0.2               BTC (meaning I **bought** 500 ETH for 0.2 BTC)
Feb/2017      700           ETH                     0.3               BTC (meaning I **bought** 700 ETH  for 0.3 BTC)
Mar/2017     0.2             BTC                     400             ETH (meaning I **sold** 400 ETH  for 0.2 BTC)

What I'm looking to do is a graph that plots the amount of ETH I have throughout time.

Date Amount 
Jan/2017 500 
Feb/2017 1200 
Mar/2017 800

Thanks for your help folks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...