https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-rows-with-multiple/m-p/448061#M168267 <P>I have a search returns two rows of records (check the result from the following query):</P> <PRE><CODE>| makeresults | eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7 | append [| makeresults | eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17] | fields - _time | table date col1 col2 col3 col4 </CODE></PRE> <P>Is there a way to get the difference between the date from all the columns? Here is the expected result:</P> <PRE><CODE>| makeresults | eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7 | append [| makeresults | eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17] | append [| makeresults | eval date="diff", col1=4, col2=4, col3=10, col4=10] | fields - _time | table date col1 col2 col3 col4 </CODE></PRE> <P>Thanks</P> Wed, 18 Jul 2018 21:09:21 GMT splunkrocks2014 2018-07-18T21:09:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-rows-with-multiple/m-p/448061#M168267 <P>I have a search returns two rows of records (check the result from the following query):</P> <PRE><CODE>| makeresults | eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7 | append [| makeresults | eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17] | fields - _time | table date col1 col2 col3 col4 </CODE></PRE> <P>Is there a way to get the difference between the date from all the columns? Here is the expected result:</P> <PRE><CODE>| makeresults | eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7 | append [| makeresults | eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17] | append [| makeresults | eval date="diff", col1=4, col2=4, col3=10, col4=10] | fields - _time | table date col1 col2 col3 col4 </CODE></PRE> <P>Thanks</P> Wed, 18 Jul 2018 21:09:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-rows-with-multiple/m-p/448061#M168267 splunkrocks2014 2018-07-18T21:09:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-rows-with-multiple/m-p/448062#M168268 <P>@splunkrocks2014 ,</P> <P>Try this,</P> <PRE><CODE>| makeresults | eval date="2018-07-16", col1=4, col2=5, col3=6, col4=7 | append [| makeresults | eval date="2018-07-17", col1=8, col2=9, col3=16, col4=17] | fields - _time | table date col1 col2 col3 col4 | transpose|rename "row 1" as row1,"row 2" as row2 | eval diff=if(column!="date",(row2-row1),null()) | transpose header_field=column|fields - column|fillnull value=diff date </CODE></PRE> Thu, 19 Jul 2018 04:29:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-difference-between-two-rows-with-multiple/m-p/448062#M168268 renjith_nair 2018-07-19T04:29:37Z