topic Re: How do I add every two rows into a seperate column? in Splunk Search

How do I add every two rows into a seperate column?

akhera — Tue, 16 Oct 2018 11:36:21 GMT

I want to add every two rows in a column and display them in new column as new total:

Column1
1

2
5

7
8

9

NewTotalColum

Any leads will be helpful.

Re: How do I add every two rows into a seperate column?

renjith_nair — Tue, 16 Oct 2018 14:36:17 GMT

@akhera,

Try this,

your search|streamstats current=f window=1 last(Column1) as prev|eval rowno=1|accum rowno
|eval Total=if(rowno%2==0,Column1+prev,null())|fields - rowno,prev

You shall change the logic to display data in alternative columns if needed

Re: How do I add every two rows into a seperate column?

mstjohn_splunk — Thu, 18 Oct 2018 16:17:43 GMT

Hi @akhera,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

Re: How do I add every two rows into a seperate column?

akhera — Wed, 24 Oct 2018 08:36:17 GMT

@mstjohn_splunk @renjith.nair This is really helpful and it solved my issue. thanks for your help and support.