Splunk Search

subtraction doesn't work for multiple values in one field

almond14
Engager

I managed to create a table that somewhat looks like this:
alt text

However, when I tried to append a new column with the differences between after and before as its value, it just gave me a blank space. I used eval differences=after-before which apparently doesn't work. Is there some other workaround on this? I need to get the list of differences so the end result should look something like below:
alt text

I need to have that column so I can process the average, min, and max difference for each name1, name2, etc.

Thanks!

0 Karma

woodcock
Esteemed Legend

See answer by @sundareshr but also tack on this:

... | stats list(before) AS before list(after) AS after list(diff) AS diff BY names

sundareshr
Legend

Try this

.. | eval z=mvzip(before, after, "@") | mvexpand z | rex field=z "(?<before>.*)@(?<after>.*)" | table names, before, after | eval diff=after-before
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...