Splunk Search

How do I sum or subtract values depending on 2 distinct fields and chart them?

ADRIANODL
Explorer

Hi folks,

I have a table in the following format:

Date              Buy(qty)  CurrencyBuy      Sell(qty)       CurrencySell    
Jan/2017       500           ETH                     0.2               BTC (meaning I **bought** 500 ETH for 0.2 BTC)
Feb/2017      700           ETH                     0.3               BTC (meaning I **bought** 700 ETH  for 0.3 BTC)
Mar/2017     0.2             BTC                     400             ETH (meaning I **sold** 400 ETH  for 0.2 BTC)

What I'm looking to do is a graph that plots the amount of ETH I have throughout time.

Date Amount 
Jan/2017 500 
Feb/2017 1200 
Mar/2017 800

Thanks for your help folks!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ADRIANODL,

Can you please try the following search?

YOUR_SEARCH
| rename "Buy(qty)" as Buy_qty_ , "Sell(qty)" as Sell_qty_ 
| table Date Buy_qty_ CurrencyBuy Sell_qty_ CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) 
| accum Amount 
| table Date Amount

My Sample Search:

| makeresults 
| eval _raw="
Date Buy(qty) CurrencyBuy Sell(qty) CurrencySell 
Jan/2017 500 ETH 0.2 BTC
Feb/2017 700 ETH 0.3 BTC
Mar/2017 0.2 BTC 400 ETH" 
| multikv 
| table Date Buy_qty_ CurrencyBuy "Sell_qty_" CurrencySell 
| eval Amount = if(CurrencyBuy="ETH",Buy_qty_,(-1)*Sell_qty_) | accum Amount | table Date Amount

Thanks

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...