topic Output fields based on values(current row) and values(previous row) in Splunk Search https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/554002#M157270 <P>Hi,</P><P>Im looking a way to eval values between 2 subsequence row. Please take a look on below.</P><P><BR />my statictis table:</P><TABLE border="1" width="150.8px"><TBODY><TR><TD width="75.2px" height="24px">Product&nbsp;</TD><TD width="74.4px" height="24px">quality</TD></TR><TR><TD width="75.2px" height="24px">phone_a</TD><TD width="74.4px" height="24px">40</TD></TR><TR><TD width="75.2px" height="24px">phone_b</TD><TD width="74.4px" height="24px">50</TD></TR><TR><TD width="75.2px" height="24px">phone_c</TD><TD width="74.4px" height="24px">40</TD></TR><TR><TD width="75.2px" height="24px">phone_d</TD><TD width="74.4px" height="24px">70</TD></TR></TBODY></TABLE><P><BR />Expected output:</P><TABLE border="1"><TBODY><TR><TD width="20%" height="24px">Product&nbsp;</TD><TD width="20%" height="24px">quality</TD><TD width="20%" height="24px">score_current_vs_previous</TD></TR><TR><TD width="20%" height="24px">phone_a</TD><TD width="20%" height="24px">40</TD><TD width="20%" height="24px">&nbsp;</TD></TR><TR><TD width="20%" height="24px">phone_b</TD><TD width="20%" height="24px">50</TD><TD width="20%" height="24px">10</TD></TR><TR><TD width="20%" height="24px">phone_c</TD><TD width="20%" height="24px">40</TD><TD width="20%" height="24px">-10</TD></TR><TR><TD width="20%" height="24px">phone_d</TD><TD width="20%" height="24px">70</TD><TD width="20%" height="24px">30</TD></TR></TBODY></TABLE><P><BR />As you can see, the score_current_vs_previous= quality(current row) - quality(previous row)<BR /><BR />Appreciate your help, thanks.</P> Wed, 02 Jun 2021 03:06:53 GMT yuming1127 2021-06-02T03:06:53Z Output fields based on values(current row) and values(previous row) https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/554002#M157270 <P>Hi,</P><P>Im looking a way to eval values between 2 subsequence row. Please take a look on below.</P><P><BR />my statictis table:</P><TABLE border="1" width="150.8px"><TBODY><TR><TD width="75.2px" height="24px">Product&nbsp;</TD><TD width="74.4px" height="24px">quality</TD></TR><TR><TD width="75.2px" height="24px">phone_a</TD><TD width="74.4px" height="24px">40</TD></TR><TR><TD width="75.2px" height="24px">phone_b</TD><TD width="74.4px" height="24px">50</TD></TR><TR><TD width="75.2px" height="24px">phone_c</TD><TD width="74.4px" height="24px">40</TD></TR><TR><TD width="75.2px" height="24px">phone_d</TD><TD width="74.4px" height="24px">70</TD></TR></TBODY></TABLE><P><BR />Expected output:</P><TABLE border="1"><TBODY><TR><TD width="20%" height="24px">Product&nbsp;</TD><TD width="20%" height="24px">quality</TD><TD width="20%" height="24px">score_current_vs_previous</TD></TR><TR><TD width="20%" height="24px">phone_a</TD><TD width="20%" height="24px">40</TD><TD width="20%" height="24px">&nbsp;</TD></TR><TR><TD width="20%" height="24px">phone_b</TD><TD width="20%" height="24px">50</TD><TD width="20%" height="24px">10</TD></TR><TR><TD width="20%" height="24px">phone_c</TD><TD width="20%" height="24px">40</TD><TD width="20%" height="24px">-10</TD></TR><TR><TD width="20%" height="24px">phone_d</TD><TD width="20%" height="24px">70</TD><TD width="20%" height="24px">30</TD></TR></TBODY></TABLE><P><BR />As you can see, the score_current_vs_previous= quality(current row) - quality(previous row)<BR /><BR />Appreciate your help, thanks.</P> Wed, 02 Jun 2021 03:06:53 GMT https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/554002#M157270 yuming1127 2021-06-02T03:06:53Z Re: Output fields based on values(current row) and values(previous row) https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/554010#M157273 <P>See this example search using your data set. What you need is from streamstats command</P><LI-CODE lang="markup">| makeresults | eval _raw="Product quality phone_a 40 phone_b 50 phone_c 40 phone_d 70" | multikv forceheader=1 | table Product quality | streamstats window=1 current=f first(quality) as prev_quality | eval score_current_vs_previous=quality-prev_quality | table Product quality score_current_vs_previous</LI-CODE> Wed, 02 Jun 2021 03:37:03 GMT https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/554010#M157273 bowesmana 2021-06-02T03:37:03Z Re: Output fields based on values(current row) and values(previous row) https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/555713#M157758 <P>Great one thanks</P> Tue, 15 Jun 2021 03:35:07 GMT https://community.splunk.com/t5/Splunk-Search/Output-fields-based-on-values-current-row-and-values-previous/m-p/555713#M157758 yuming1127 2021-06-15T03:35:07Z