topic Re: How to compare last value with the 7th last value? in Splunk Search

How to compare last value with the 7th last value?

aguasd12 — Tue, 11 Apr 2023 01:44:50 GMT

How to compare last value with the second last value?

Say I have a column with N records in it
88
22
67. -->
44
55
12
44
75
80 -->

I want to compare the last record 80 with that of 67( last value and want to write whether the value was 'greater' or 'smaller' in the output.

In above case 55 was greater so my output should say GREATER. Do we have any command to accomplish this?

Re: How to compare last value with the 7th last value?

yeahnah — Tue, 11 Apr 2023 03:27:50 GMT

Hi @aguasd12

An interesting use case. Something like this should work...

Hope that helps

Re: How to compare last value with the 7th last value?

yeahnah — Tue, 11 Apr 2023 04:12:33 GMT

On rereading your question I see I misunderstood it, initially. This should meet you use case

Re: How to compare last value with the 7th last value?

yuanliu — Tue, 11 Apr 2023 06:57:32 GMT

How to compare last value with the second last value?
....
I want to compare the last record 80 with that of 67( last value and want to write whether the value was 'greater' or 'smaller' in the output.
In above case 55 was greater so my output should say GREATER. ...

You may need to describe the use case with consistency. The title says last vs 7th last, which kinda agrees with 80 vs 67. Then, the opening sentence says last with second last; and the last sentence cites a number 55 which is neither the 7th last nor the second last.

Here, I'll take 7th last. The following statement also needs clarification:

Say I have a column with N records in it

Does this mean that the column is multivalued with 7 records, or does it mean that you have 7 separate events with this column?

If former, a semantical interpretation of your requirement (compare with 7th last) is

| eval output = if(tonumber(mvindex(column, -1)) - tonumber(mvindex(column, -7)) > 0, "GREATER", "SMALLER or EQUAL")

If latter, you first make the column multivalued with original sequence.

| stats list(column) as column | eval output = if(tonumber(mvindex(column, -1)) - tonumber(mvindex(column, -7)) > 0, "GREATER", "SMALLER or EQUAL")

Here, I also do not know if you want EQUAL to be a separate output so I'm using the simplest if() function. If you need a separate EQUAL, it would be more economic to save output of mvindex to variables (fields) before applying case() command.

Hope this helps.