Splunk Search

I have to subtract between 2 alternate rows. Like Row2-1,Row 4-3 . Not the difference between the consecutive rows. I used "Diff" but it gives diff b/w each row. Please suggest.

BTCM
Engager

TXName Period Value diffValue
tx1 Period 1 25

tx1 Period 2 14 -11
tx2 Period 1 12

tx2 Period 2 20 8

I need to calculate the "value" difference of tx1& tx2 respect to Period.

Tags (2)
0 Karma
1 Solution

javiergn
Super Champion

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

View solution in original post

0 Karma

javiergn
Super Champion

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...