Splunk Search

Getting values from a field and comparing them

mauricio2354
Explorer

I have the following query:

index=source sourcetype=type_example | bin _time span=5m| eval TIME=strftime(_time,"%D:%H:%M") | search (CountryCode="US") | eval transaction_type=case( searchmatch(" eventName=event1 OR eventName=event2") , "Example Info" ) | eval series=ProductDescription."/".transaction_type | where statusCode="1" | chart count as total_count over TIME | tail 2

When I run this query over the past 5 minutes, it gives me a table with two volume results for two time periods, like so:

alt text

I want to assign those two values (211 and 204) to two different variables (count1 and count2), so that I can end up with another result. In the end, I want two more values, count3 = count1 - count2, and count4 = .3 * count1.

Please help, I've been stuck on this forever 😞

Thank you!

Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Try this

<your query so far with columns TIME and total_count>
| sort - total_count 
| transpose column_name=TIME 
| search TIME=total_count 
| rename "row *" as count* 
| eval count3=count1-count2,count4=round(.3*count1,2)

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Try this

<your query so far with columns TIME and total_count>
| sort - total_count 
| transpose column_name=TIME 
| search TIME=total_count 
| rename "row *" as count* 
| eval count3=count1-count2,count4=round(.3*count1,2)

let me know if this helps!

mauricio2354
Explorer

This helped immensely, thank you so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...