How can I calculate 2 different search result

[chappe4]

If I do a search in on index and get a value then I need to search another index to get second value. How can I combine these so I am able to calculate the difference? Like 10 - 5 = 5 and then display the result. Is there a way to get the search result into a variable?

Here is an example of the search.

So from this I would like to calculate block - deliver =
Leif

[cramasta]

AHH man i was not thinking about this right, those are not field names in the first search, the fields would be search_name and count. The only way I can think of doing this right now is like this, and please someone tell me better way to go about this.

(index=sentrion-summary-fine search_name="Firewall Block") OR (index=sentrion-summary-fine search_name="Summarize Message Categorization, Disposition by 30min" disposition="Deliver" cluster="cluster_1") | stats count AS theCount by search_name | sort + search_name | transpose | search NOT column=search_name | rename row1 AS FB | rename row2 AS SMC | eval newvalue=FB-SMC | table FB SMC newvalue

[cramasta]

(index=sentrion-summary-fine search_name="Firewall Block") OR (index=sentrion-summary-fine search_name="Summarize Message Categorization, Disposition by 30min" disposition="Deliver" cluster="cluster_1") | stats count by search_name

that should give you two columns that you can then calculate the difference using an eval statment

[chappe4]

Actually the Firewall block was a typo from my side. so the rename is correct.
But still the eval is not working on the.
(index=sentrion-summary-fine search_name="Firewall Block") OR (index=sentrion-summary-fine search_name="Summarize Message Categorization, Disposition by 30min" disposition="Deliver" cluster="cluster_1") | stats count by search_name | rename "Firewall Block" AS FB | rename "Summarize Message Categorization, Disposition by 30min" AS SMC | eval newvalue=FB-SMC

Only get the result
Firewall Block
Summarize Message Categorization, Disposition by 30min

[cramasta]

Things in Splunk are case sensitive, make sure when you are using the rename command that they are in the same case format that is listed in the results.

so if the output is showing the field as
Firewall block <-with a lowercase b
then the rename command is

| rename "Firewall block" AS fb

[chappe4]

If I then try this one:
index=sentrion-summary-fine search_name="Firewall Block" |stats count(host) as block | appendcols [ search index=sentrion-summary-fine search_name"Summarize Message Categorization, Disposition by 30min" | search disposition="Deliver" cluster="cluster_1" | stats count as deliver] | eval newvalue=block-deliver
I get this output

block deliver newvalue
121003 56335 64668

[chappe4]

Hello,

If I use this:
(index=sentrion-summary-fine search_name="Firewall Block") OR (index=sentrion-summary-fine search_name="Summarize Message Categorization, Disposition by 30min" disposition="Deliver" cluster="cluster_1") | stats count by search_name | rename "Firewall Block" AS FB | rename "Summarize Message Categorization, Disposition by 30min" AS SMC | eval newvalue=FB-SMC
I get this output
Firewall block 121003
Summarize Message Categorization, Disposition by 30min 56335

[chappe4]

Thanks, sorry but I'm new to splunk and not use to its language yet. So one more thing how can I now show the result of the eval newvalue=FB-SMC in the report?

[cramasta]

Because your new field names are the names of the saved search and that they have spaces in them you can not use eval to calculate the difference. you need to first rename the columns so they do not have spaces.

(index=sentrion-summary-fine search_name="Firewall Block") OR (index=sentrion-summary-fine search_name="Summarize Message Categorization, Disposition by 30min" disposition="Deliver" cluster="cluster_1") | stats count by search_name | rename "Firewall Block" AS FB | rename "Summarize Message Categorization, Disposition by 30min" AS SMC | eval newvalue=FB-SMC

[chappe4]

Thanks for the tips it was useful. I know have to figure out how to use the eval statement.

[cramasta]

you could also use appendcols command but this would kick off two searches.

index=sentrion-summary-fine search_name="Firewall Block" |stats count(host) as block | appendcols [ search index=sentrion-summary-fine search_name"Summarize Message Categorization, Disposition by 30min" | search disposition="Deliver" cluster="cluster_1" | stats count as deliver]