topic How to subtract field values and have the result in a new field? in Splunk Search

How to subtract field values and have the result in a new field?

russell120 — Thu, 20 Sep 2018 20:17:28 GMT

Hi, please view my example csv.

file1.csv:

Apples  Bananas    Oranges    Grapes
50        44         83         121

I would like a new column that would show the difference in each field from left to right so that the table would then look like this:

Apples  Bananas    Oranges    Grapes    Delta
50        44         83         121       6 
                                         39
                                         38

What SPL could I use to accomplish this?? In the end, I intend to display the values in the Delta field as a line graph visualization across the values of the fruit while they're displayed as a bar graph. I know it doesn't make much sense logically but work with me here lol.

Re: How to subtract field values and have the result in a new field?

harishalipaka — Fri, 21 Sep 2018 06:07:41 GMT

hi @russell120

can u try like this

|makeresults |eval  Apples=50,Bananas=44,Oranges=83,Grapes=121 |table  Apples Bananas Oranges Grapes|transpose |delta "row 1" as delta|transpose header_field=column |fields - column

Re: How to subtract field values and have the result in a new field?

renjith_nair — Sat, 22 Sep 2018 05:19:25 GMT

@russell120,

If you have defined number of columns, then try

"your search" |eval Delta=abs(Apples-Bananas)."#".abs(Bananas-Oranges)."#".abs(Oranges-Grapes)|makemv delim="#" Delta