topic Re: How to compare last value with the second last value? in Splunk Search

How to compare last value with the second last value?

ariyazudeen — Wed, 31 Aug 2016 06:22:22 GMT

Say I have a column with 5 records in it
88
22
67
44
55

I want to compare the last record 55 with that of second last value and want to write whether the value was 'greater' or 'smaller' in the output.

In above case 55 was greater so my output should say GREATER. Do we have any command to accomplish this?

Re: How to compare last value with the second last value?

sundareshr — Wed, 31 Aug 2016 12:53:31 GMT

Try this

base search | tail 2 | delta field as difference | eval greater=if(difference>0, "Yes", "no")

*OR*

base search | delta field as difference | reverse | eval greater=if(difference>0, "Yes", "no")

Re: How to compare last value with the second last value?

knielsen — Wed, 31 Aug 2016 12:54:03 GMT

Maybe a combination of tail and delta? Assuming the fieldname of the column was "val":

| inputlookup test.csv | tail 2 | delta val as delta | eval output=case(delta<0,"GREATER",delta>0,"LESSER",true(),"EQUAL") | fields output | tail 1

Hth,
Kai.

edit: damn, 32secs late... 😉

Re: How to compare last value with the second last value?

ariyazudeen — Thu, 01 Sep 2016 04:46:33 GMT

Can you explain how this above query works. It is working but I'm not sure how if you compare (output=case(delta<0,"GREATER",delta>0,"LESSER",true(),"EQUAL") with Zero value it is giving the desire result.

Re: How to compare last value with the second last value?

ariyazudeen — Thu, 01 Sep 2016 05:14:44 GMT

I got it now. Thanks 🙂