Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to incrementally subtract values to calculate duration

$
0
0
Hi all, I'm running a search which outputs something like this, ( where time_diff is the date the code was loaded, subtracted from the date the search is ran in days)- Machine_Serial Bundle time_diff 75BMY43 1.1 50 1.2 25 1.3 5 1.4 3 75RAB99 1.2 30 1.3 10 1.4 5 What I am trying to achieve is to take one time_diff then subtract the proceeding time_diff so the last two time_diff's in for Machine_Serial would be 50-25=25 then 25-5=20 and so forth, up until the most current which would be 3 ( nothing is done to this one since it is currently on this level and it should grow until another Bundle is loaded). I hope that by using this method I can get the amount of time that the Bundle was loaded on a machine, with out it growing. So it would look something like this Machine_Serial Bundle time_diff time_on_machine 75BMY43 1.1 50 25 1.2 25 20 1.3 5 2 1.4 3 3 75RAB99 1.2 30 20 1.3 10 5 1.4 5 5 Is there any way I can achieve this? Thank you and please let me know if there are any questions.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>