https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407526#M117701 <P>@Vijeta please guide.</P> Tue, 04 Jun 2019 17:01:53 GMT reverse 2019-06-04T17:01:53Z https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407525#M117700 <P>q1- how can i get c4 where c4 will always be difference of values in c3 against first of c2 - next of c2<BR /> for example .. here c4 for A = 76-7 .. 7-6 ... 6-677.. and so on </P> <P>Please guide.</P> <PRE><CODE>c1 c2 c3 A 1 76 A 2 7 A 3 6 A 4 677 B 1 65 B 2 675 B 3 90 B 4 78 C 1 121 C 2 56 C 3 54 C 4 67 D 1 56 D 2 6 D 3 5 D 4 657 </CODE></PRE> Tue, 04 Jun 2019 16:58:57 GMT https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407525#M117700 reverse 2019-06-04T16:58:57Z https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407526#M117701 <P>@Vijeta please guide.</P> Tue, 04 Jun 2019 17:01:53 GMT https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407526#M117701 reverse 2019-06-04T17:01:53Z https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407527#M117702 <P>@reverse Try this</P> <PRE><CODE>&lt;your query&gt; | sort c1,c2|streamstats list(c3) as list , count as count by c1| eval diff = mvindex(list, count-2)| eval c4= c3 - diff </CODE></PRE> Tue, 04 Jun 2019 18:19:01 GMT https://community.splunk.com/t5/Splunk-Search/playing-with-data-II/m-p/407527#M117702 Vijeta 2019-06-04T18:19:01Z