topic Generic Solution to Same Column Value Difference in Splunk Search

Generic Solution to Same Column Value Difference

reverse — Thu, 25 Jul 2019 16:23:59 GMT

What would be the best generic solution to

https://answers.splunk.com/answers/760677/same-column-value-difference.html?minQuestionBodyLength=80

what if there are multiple As Bs Cs and Ds. As of now mentioned solution is perfect for just 2 same corresponding values.

Re: Generic Solution to Same Column Value Difference

reverse — Thu, 25 Jul 2019 16:24:55 GMT

@Vijeta Please visit here.

Re: Generic Solution to Same Column Value Difference

reverse — Wed, 31 Jul 2019 18:36:36 GMT

@Vijeta @jnudell_2 Please guide.

Re: Generic Solution to Same Column Value Difference

jnudell_2 — Wed, 31 Jul 2019 20:05:05 GMT

Be a little bit more specific. If you have three values for C1=A of 10, 4, 5. What would you consider the difference? Difference only works for two values. Unless you mean the difference of the most recent value, minus all previous values (Ie; 10 - 4 - 5 = 1).

C1  C2
---------- 
A   10
A   4
A   5

What would you consider the "difference" for the above?

Re: Generic Solution to Same Column Value Difference

reverse — Wed, 31 Jul 2019 23:14:52 GMT

2nd index value - 1st index value
3rd index value - 2nd index value

basically 0->n
n- (n+1)
where n is the mv index

 C1  C2
 ---------- 
 A   10
 A   4
 A   5

in this example

diff will be -6 and 1

Re: Generic Solution to Same Column Value Difference

woodcock — Thu, 01 Aug 2019 15:37:42 GMT

Like this:

| makeresults 
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12 
    [eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
  | eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")

Re: Generic Solution to Same Column Value Difference

reverse — Thu, 01 Aug 2019 15:46:37 GMT

THANK YOU !!!!!