topic Subtracting column when column name are dynamic in Splunk Search

Subtracting column when column name are dynamic

kiamyash — Tue, 28 Jul 2020 11:12:42 GMT

Hello World.

I have a splunk search which results in the below table...

My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.

Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values.

renjith_nair — Tue, 28 Jul 2020 13:50:49 GMT

Try

"your current search" |eval _prev=0 |foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev | eval _prev=<<FIELD>>]

This will create additional fields with diff as prefix.

If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>

Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name