topic Re: highest - lowest in a row in Splunk Search

highest - lowest in a row

reverse — Thu, 07 Nov 2019 20:15:27 GMT

Date    X   Y   Z   XX  Max Delta 
10/1/2019   315 205 258 270 110
10/2/2019   293 194 235 247 99
10/3/2019   309 210 266 274 99
10/4/2019   312 208 256 266 104
10/5/2019   6   3   0   1   6
10/6/2019   82  35  71  68  47
10/7/2019   270 204 234 249 66
10/8/2019   315 216 271 279 99
10/9/2019   294 197 235 248 97
10/10/2019  314 212 267 277 102
10/11/2019  308 207 256 266 101
10/12/2019  120 11  70  69  109

How to achieve max delta column ?

simply put , highest - lowest for EVERY row ?

Re: highest - lowest in a row

somesoni2 — Thu, 07 Nov 2019 20:41:04 GMT

Try this

your current search giving fields Date X Y Z XX
| untable Date metrics value
| appendpipe [| stats max(value) as max min(value) as min by Date
| eval value=max-min | table Date MaxDelta | eval metrics="Max Delta" ]
| xyseries Date metrics value

Re: highest - lowest in a row

reverse — Thu, 07 Nov 2019 21:34:17 GMT

| stats max(value) as max min(value) as min by Date.. didn't produce anything ...

Re: highest - lowest in a row

somesoni2 — Thu, 07 Nov 2019 22:21:34 GMT

What's the full search you tried??

Re: highest - lowest in a row

reverse — Fri, 08 Nov 2019 14:45:26 GMT

Re: highest - lowest in a row

reverse — Mon, 11 Nov 2019 17:04:30 GMT

@Vijeta please look at this.