topic Re: How to use Foreach for multiple columns and multiple rows? in Splunk Search

topic Re: How to use Foreach for multiple columns and multiple rows? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525855#M148412 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781">@renjith_nair</a> thanks for the answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Wed, 21 Oct 2020 16:16:27 GMT ChioNeng 2020-10-21T16:16:27Z How to use Foreach for multiple columns and multiple rows? https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525043#M148125 <P>Hello, I'm having trouble figuring out how to use foreach + eval getting the difference of the fields.</P><P>I have something like this: </P><P><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="have.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11331i62E7D87B2FD30385/image-size/large?v=v2&px=999" role="button" title="have.PNG" alt="have.PNG" /></span></P><P> <BR />You can use this search to obtained the above result: </P><P> </P><TABLE border="1" width="100%"><TBODY><TR><TD width="100%">| makeresults<BR />| eval Country="PH"<BR />| eval "2020-01 Actual"=1<BR />| eval "2020-01 Forecast"=2<BR />| eval "2020-02 Actual"=5<BR />| eval "2020-02 Forecast"=4<BR />| eval "2020-03 Actual"=50<BR />| eval "2020-03 Forecast"=20<BR />| append<BR />[| makeresults<BR />| eval Country="IND"<BR />| eval "2020-01 Actual"=3<BR />| eval "2020-01 Forecast"=3<BR />| eval "2020-02 Actual"=2<BR />| eval "2020-02 Forecast"=2<BR />| eval "2020-03 Actual"=40<BR />| eval "2020-03 Forecast"=23<BR />]<BR />| append<BR />[| makeresults<BR />| eval Country="SG"<BR />| eval "2020-01 Actual"=2<BR />| eval "2020-01 Forecast"=4<BR />| eval "2020-02 Actual"=1<BR />| eval "2020-02 Forecast"=9<BR />| eval "2020-03 Actual"=30<BR />| eval "2020-03 Forecast"=53 ]<BR />| fields - _time</TD></TR></TBODY></TABLE><P> </P><P><SPAN>And I'm trying to use foreach/eval to get this:</SPAN></P><P><SPAN><span class="lia-inline-image-display-wrapper lia-image-align-center" image-alt="want.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11332i4BC23C1C3D2715CD/image-size/large?v=v2&px=999" role="button" title="want.PNG" alt="want.PNG" /></span></SPAN></P><P> </P><P><SPAN>Thanks in advance <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </SPAN></P> Fri, 16 Oct 2020 11:51:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525043#M148125 ChioNeng 2020-10-16T11:51:50Z Re: How to use Foreach for multiple columns and multiple rows? https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525054#M148128 <P>Try</P><LI-CODE lang="markup">| makeresults | eval Country="PH" | eval "2020-01 Actual"=1 | eval "2020-01 Forecast"=2 | eval "2020-02 Actual"=5 | eval "2020-02 Forecast"=4 | eval "2020-03 Actual"=50 | eval "2020-03 Forecast"=20 | append [| makeresults | eval Country="IND" | eval "2020-01 Actual"=3 | eval "2020-01 Forecast"=3 | eval "2020-02 Actual"=2 | eval "2020-02 Forecast"=2 | eval "2020-03 Actual"=40 | eval "2020-03 Forecast"=23 ] | append [| makeresults | eval Country="SG" | eval "2020-01 Actual"=2 | eval "2020-01 Forecast"=4 | eval "2020-02 Actual"=1 | eval "2020-02 Forecast"=9 | eval "2020-03 Actual"=30 | eval "2020-03 Forecast"=53 ] | fields - _time | eval prev=0 | foreach 20* [eval <<FIELD>>_DIFF='<<FIELD>>' - prev|eval prev='<<FIELD>>'] | fields - *Actual_DIFF,prev | rename "* Forecast_DIFF" as "* Difference"</LI-CODE><P> </P><P> </P> Fri, 16 Oct 2020 13:04:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525054#M148128 renjith_nair 2020-10-16T13:04:37Z Re: How to use Foreach for multiple columns and multiple rows? https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525855#M148412 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781">@renjith_nair</a> thanks for the answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Wed, 21 Oct 2020 16:16:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-Foreach-for-multiple-columns-and-multiple-rows/m-p/525855#M148412 ChioNeng 2020-10-21T16:16:27Z