topic Re: Same Column Value Difference in Splunk Search

Same Column Value Difference

reverse — Thu, 25 Jul 2019 14:16:14 GMT

C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86

how to find difference in values of C2 for every same C1 value

Re: Same Column Value Difference

reverse — Thu, 25 Jul 2019 14:16:51 GMT

@Vijeta Please guide.

Re: Same Column Value Difference

vnravikumar — Thu, 25 Jul 2019 14:19:55 GMT

Example, please

Re: Same Column Value Difference

reverse — Thu, 25 Jul 2019 14:21:34 GMT

It is there ..

C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86

Re: Same Column Value Difference

vnravikumar — Thu, 25 Jul 2019 14:31:34 GMT

Try this

source="diff.csv" host="ind1" sourcetype="csv" 
| table C1 C2 
| sort C1 
| stats values(C2) as C2 by C1 
| eval num1 = mvindex(C2,0) 
| eval num2 = mvindex(C2,1) 
| eval diff = num2-num1 
| table C1,C2,diff

Re: Same Column Value Difference

reverse — Thu, 25 Jul 2019 14:37:32 GMT

It worked!!!

Thank you !!!.. but what if there are multiple As Bs Cs and Ds
As of now this solution is perfect for 2 same values.

Re: Same Column Value Difference

reverse — Thu, 25 Jul 2019 14:39:00 GMT

@vnravikumar can we make a generic solution ?

Re: Same Column Value Difference

reverse — Thu, 25 Jul 2019 15:01:12 GMT

@Vijeta @jnudell_2 You around folks ?

Re: Same Column Value Difference

reverse — Thu, 25 Jul 2019 16:42:06 GMT

https://answers.splunk.com/answers/760695/generic-solution-to-same-column-value-difference.html?minQuestionBodyLength=80