Splunk Search

How to get the differece between each events using streamstats?

Rajkumarkbm
Engager

I want to get the difference the events. Please find the below.

Eg:

Field1 Field2 Field3 Diff
ABC 200 CCBA 0
DEF 500 DFDG 0
ABC 600 WERT 400
DEF 200 ERTY -100
ABC 800 WERT 200
DEF 700 ERTY 500

How do I can get the result like the above.?

Tags (1)
0 Karma

HiroshiSatoh
Champion

Efficiency is bad because we perform the same search twice using JOIN. Since we are using sub search, there is a default number limit.

(your search)
|streamstats count as key by Field1
|join type=left Field1,key
     [search (your search)|table Field1 Field2|streamstats count as key  by Field1|eval key=key-1
          |rename Field2 as bf_Field2]
|eval Diff=Field2-bf_Field2| fillnull value=0 Diff
|table Field1 Field2 Field3 Diff
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...