topic Re: Move all values from column, one row up in Splunk Search

How do I move all values from column one row up?

nmsaraujo — Mon, 05 Sep 2022 22:29:09 GMT

Hello everyone,

Can not find how I may move all values from a column(Total), one row up, in a table

This is my current scenario

Day	Total
Monday
Tuesday	2
Wednesday	3
Thursday	4
Friday	5
Saturday	6
Sunday	7

This is my desired scenario:

Day	Total
Monday	2
Tuesday	3
Wednesday	4
Thursday	5
Friday	6
Saturday	7
Sunday

Can anyone help me please?

Thanks in advance

Re: Move all values from column, one row up

richgalloway — Mon, 05 Sep 2022 13:47:58 GMT

Please share the query that produced that table so we help you determine why totals are in the wrong place. There is no "move up" command in SPL.

Re: Move all values from column, one row up

nmsaraujo — Mon, 05 Sep 2022 14:12:38 GMT

Thanks for the quick reply @richgalloway

I am trying to make something similar to this:

index=_internal sourcetype=scheduler
| head 10
| delta _time as time_delta
| fillnull value="need to move next values here" time_delta
| table _time time_delta

Does this help?

Re: Move all values from column, one row up

richgalloway — Mon, 05 Sep 2022 20:26:00 GMT

The delta command calculates the difference between the value of a field in the current event and the value of the same field in the previous event. Since the first result has no previous event, the delta is undefined (null).

One workaround may be to reverse the events, compute the delta, then reverse everything back.

Re: Move all values from column, one row up

nmsaraujo — Tue, 06 Sep 2022 07:24:58 GMT

Thanks once more @richgalloway , but what I am looking for is really to write the values in a different row. This doesn't worked for what I am looking for.

I am looking to see if I can do it with mvindex.

Cheers