https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617313#M214535 <P>Try something like this</P><LI-CODE lang="markup">| sort 0 _time | streamstats window=1 current=f global=f values(ComputerValue) as PreviousComputerValue by ComputerName | eval diff=ComputerValue-PreviousComputerName</LI-CODE> Mon, 17 Oct 2022 08:27:32 GMT ITWhisperer 2022-10-17T08:27:32Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617312#M214534 <P>I am trying to figure out a way to calculate a field in a set of data. In my search im returned events from a long list of computers. For lack of a better explanation, I have events that essentially each computer will throw once a day at the same time every day. I will have logs that have fields ComputerName, and ComputerValue. Every day the ComputerValue will be a different numeric value. I need to create a new field in each log that will be the difference between the ComputerValue field. So if day 1, Computer1 gives ComputerValue 10, and day 2 Computer1 gives ComputerValue 12, I need to at search time add a field to Computer1 that would be day 2 value minus day 1 value positive or negative. So day 2 will also have a value ComputerDifference of 2. and if day 3 computerValue is 8, it would be ComputerValue of day 2 minus day 3 and ComputerDifference would be -4.<BR /><BR />Its something I could easily do in Excel but I cant figure out a way to do it here. Any suggestions?&nbsp;</P> Mon, 17 Oct 2022 14:45:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617312#M214534 zbsplunker 2022-10-17T14:45:54Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617313#M214535 <P>Try something like this</P><LI-CODE lang="markup">| sort 0 _time | streamstats window=1 current=f global=f values(ComputerValue) as PreviousComputerValue by ComputerName | eval diff=ComputerValue-PreviousComputerName</LI-CODE> Mon, 17 Oct 2022 08:27:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617313#M214535 ITWhisperer 2022-10-17T08:27:32Z https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617327#M214538 <P>Dang thanks, never used streamstats this is great</P> Mon, 17 Oct 2022 10:10:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-a-calculated-field/m-p/617327#M214538 zbsplunker 2022-10-17T10:10:58Z