topic Re: Compare the row values to the above row. in Splunk Search

Compare the row values to the above row.

vinod743374 — Sun, 11 Jul 2021 03:37:38 GMT

Compare the row value with the above row value ,
if the above row value is grater than the present row value, it should be replaced with the above value,
otherwise remains same.

i have a table like the above image,
you can observe date wise sum data , third row values should compare with the second row , if it is grater than the above value it should replace with the higher value>

if anyone suggest me any other method , it would be also appreciated.

i think you guys understand, what i requested ,

please help me out

Re: Compare the row values to the above row.

kamlesh_vaghela — Sun, 11 Jul 2021 04:54:53 GMT

@vinod743374

Can you please try this?

Your_search | streamstats window=2 earliest(A) as pre_A | eval A=if(pre_A>A,pre_A,A)

Your_search | autoregress A as pre_A p=1 | eval A=if(pre_A>A,pre_A,A)

My Sample Search :

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Compare the row values to the above row.

ITWhisperer — Sun, 11 Jul 2021 10:35:09 GMT

Please can you clarify what would happen if a fourth row had value 4 in the second column, should this be replaced by 5 from row 3 or 7 from row 2 via row 3?

Re: Compare the row values to the above row.

vinod743374 — Sun, 11 Jul 2021 14:33:07 GMT

thank you for the response <

with your query,
it replaces with the the previous value ,
but in my case , it should return when ever the value is grater than the present value, otherwise it should remain same.

Re: Compare the row values to the above row.

vinod743374 — Sun, 11 Jul 2021 14:37:50 GMT

thanks for the response ,

yeah it should replaced by 7 only ,
it should replace with the higher value in the column.

if our 4th row has the highest value , it should remains same.
the same should work for all the rows.

thank you !!

Re: Compare the row values to the above row.

ITWhisperer — Sun, 11 Jul 2021 14:44:17 GMT

| streamstats max('Aaa Server-Arista') as "Aaa Server-Arista"

Re: Compare the row values to the above row.

vinod743374 — Sun, 11 Jul 2021 14:49:08 GMT

if possible , can't we generalize the query for all the rows.

Re: Compare the row values to the above row.

ITWhisperer — Sun, 11 Jul 2021 14:51:50 GMT

| streamstats max(*) as *

Re: Compare the row values to the above row.

vinod743374 — Sun, 11 Jul 2021 15:10:58 GMT

It working ,
Thankyou so much !!