Splunk Search

I have to subtract between 2 alternate rows. Like Row2-1,Row 4-3 . Not the difference between the consecutive rows. I used "Diff" but it gives diff b/w each row. Please suggest.

BTCM
Engager

TXName Period Value diffValue
tx1 Period 1 25

tx1 Period 2 14 -11
tx2 Period 1 12

tx2 Period 2 20 8

I need to calculate the "value" difference of tx1& tx2 respect to Period.

Tags (2)
0 Karma
1 Solution

javiergn
Super Champion

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

View solution in original post

0 Karma

javiergn
Super Champion

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...