topic Re: Splunk Query Help ?? in Splunk Search

Splunk Query Help ??

rakesh_498115 — Wed, 05 Sep 2012 10:39:55 GMT

Hi i have obtained the following stats from my query ..Here the list of stats i got my from query..

A
1
3
4
6
8
Now on these stats , i need to get one more column say B..which should the contain the values..like this..

i.e in B column first column must have differnce of A 2ndcolum and A 1stcolumn
similary it has get for all the values..

ie B1=(A2-A1)
B2=(A3-A2)...

so at last i need the stats like this..

A B
1 2 (A2-A1)
3 1 (A3-A2)
4 2 (A4-A3)
6 2 (A5-A4)
8 -7 (A1-A5)

Please Help ..

dart — Wed, 05 Sep 2012 10:43:58 GMT

Does the delta command do what you need?

rakesh_498115 — Wed, 05 Sep 2012 11:00:20 GMT

Yeah exactly thanx..now can i get the avg of all the values in the list and update this value in the first column of the same list...??

dart — Wed, 05 Sep 2012 11:02:25 GMT

I'm not sure I understand your desired final product. Can you draw a table illustrating this?

rakesh_498115 — Wed, 05 Sep 2012 11:06:43 GMT

yeah..

Consider this the column.

A B

2 1

3 1
4 1
6 2

here in B column first value is the avg of all the three values .. ie (1+1+2)/4=1

i have got the these three values using delta command ..

|delta A as B p=1

but i need to replace the first value with the avg of remaing values..??
please help

dart — Wed, 05 Sep 2012 11:08:35 GMT

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

rakesh_498115 — Wed, 05 Sep 2012 11:51:59 GMT

A B

2 1
3 1
4 1
6 2

this is final table where set A is obtained from my search query