topic Re: How can I reorder this table so the column B data represents the month prior? in Splunk Search

How can I reorder this table so the column B data represents the month prior?

ASISH_9 — Mon, 16 Oct 2017 10:51:50 GMT

I have the following table:

Month                 Value
September             12
October               78
November              88
December              132

I want to display the value of October in September, November in October and so on. The final output should look like this:

Month                 Value
September             78
October               88
November              132
December              Value of January

How can this be achieved? Please help. Thanks in advance.

Re: How can I reorder this table so the column B data represents the month prior?

cmerriman — Mon, 16 Oct 2017 11:47:16 GMT

try adding this to the end (assuming Value keeps growing):

...|sort 0 Value|streamstats window=1 current=f values(Month) as prevMonth|rename prevMonth as Month|where isnotnull(Month)

if Value doesn't keep growing and it is already sorted how you need it, just remove the sort command.

Re: How can I reorder this table so the column B data represents the month prior?

DalJeanis — Mon, 16 Oct 2017 12:31:30 GMT

Rather than values(), I'd generally use last() -- or even better, latest(), if there is a _time field --but they are functionally equivalent in this case.