https://community.splunk.com/t5/Splunk-Search/How-to-calculate-changes-over-multiple-column/m-p/308373#M161040 <P>you can use a streamstats command.</P> <PRE><CODE>|streamstats window=1 current=f values(*) as prev*|foreach TenGig* [eval diff_&lt;&lt;FIELD&gt;&gt;='&lt;&lt;FIELD&gt;&gt;'-prev&lt;&lt;MATCHSTR&gt;&gt;] </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Foreach">http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Foreach</A></P> Tue, 23 May 2017 14:37:02 GMT cmerriman 2017-05-23T14:37:02Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-changes-over-multiple-column/m-p/308372#M161039 <P>I have the following output from my base search:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2978iE86506740C9FF061/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>It shows accumulative value for each sampling time for each interface. Is there a good way to calculate the change for each sampling time for each interface and show the result in a similar table format?</P> <P>Thanks</P> Tue, 23 May 2017 14:05:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-changes-over-multiple-column/m-p/308372#M161039 jgcsco 2017-05-23T14:05:35Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-changes-over-multiple-column/m-p/308373#M161040 <P>you can use a streamstats command.</P> <PRE><CODE>|streamstats window=1 current=f values(*) as prev*|foreach TenGig* [eval diff_&lt;&lt;FIELD&gt;&gt;='&lt;&lt;FIELD&gt;&gt;'-prev&lt;&lt;MATCHSTR&gt;&gt;] </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Foreach">http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Foreach</A></P> Tue, 23 May 2017 14:37:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-changes-over-multiple-column/m-p/308373#M161040 cmerriman 2017-05-23T14:37:02Z