Splunk Search

2つのレコードで同一カラムの差分がとりたい

tonakano
Engager

ご教授ください

_Timeで並んだデータがあるのですが、この中の特定のカラムの出したいのですが方法はありますでしょうか?

やりたいこと の例:
日付, ID, 数, 登録日
2019/1/1 0:0:0 , ABC, 10, 2019/2/1 1:0:0
2019/1/1 0:0:1 , DEF, 20, 2019/3/1 1:0:0
2019/1/1 0:0:2 , GHI, 30, 2019/5/1 1:0:0
というデータがあったときに
登録日のカラムの差分を取り、登録日差分のカラムを追加したい。
やった結果のイメージ
日付, ID, 数, 登録日, 差分
2019/1/1 0:0:0 , ABC, 10, 2019/2/1 1:0:0, 30 ・・・1行目と2行目の登録日の差分
2019/1/1 0:0:1 , DEF, 20, 2019/3/1 1:0:0, 60 ・・・2行目と3行目の登録日の差分
2019/1/1 0:0:2 , GHI, 30, 2019/5/1 1:0:0, 90 ・・・3行目と4行目の登録日の差分

0 Karma
1 Solution

to4kawa
Ultra Champion
| makeresults 
| eval _raw="date,ID,count,assign
2019/1/1 00:00:00 , ABC, 10, 2019/2/1 01:00:00
2019/1/1 00:00:01 , DEF, 20, 2019/3/1 1:00:00
2019/1/1 00:00:02 , GHI, 30, 2019/5/1 1:00:00" 
| multikv forceheader=1 
| foreach * 
    [ eval <<FIELD>>=trim(<<FIELD>>)] 
| fields - _* linecount 
| table date,ID,count,assign 
| rename COMMENT AS "this is sample data you provide" 
| eval assign_s=strptime(assign,"%Y/%m/%d %T") 
| reverse 
| autoregress assign_s as prev 
| eval diff= prev-assign_s 
| eval diff=tostring(diff,"duration") 
| rex field=diff "(?<diff>\d.)\+" 
| reverse 
| table date,ID,count,assign,diff 
| rename date as "日付" 
| rename count as "数" 
| rename assign as "登録日" 
| rename diff as "差分"

4行目がないので、こんな感じになってしまいました。

View solution in original post

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="date,ID,count,assign
2019/1/1 00:00:00 , ABC, 10, 2019/2/1 01:00:00
2019/1/1 00:00:01 , DEF, 20, 2019/3/1 1:00:00
2019/1/1 00:00:02 , GHI, 30, 2019/5/1 1:00:00" 
| multikv forceheader=1 
| foreach * 
    [ eval <<FIELD>>=trim(<<FIELD>>)] 
| fields - _* linecount 
| table date,ID,count,assign 
| rename COMMENT AS "this is sample data you provide" 
| eval assign_s=strptime(assign,"%Y/%m/%d %T") 
| reverse 
| autoregress assign_s as prev 
| eval diff= prev-assign_s 
| eval diff=tostring(diff,"duration") 
| rex field=diff "(?<diff>\d.)\+" 
| reverse 
| table date,ID,count,assign,diff 
| rename date as "日付" 
| rename count as "数" 
| rename assign as "登録日" 
| rename diff as "差分"

4行目がないので、こんな感じになってしまいました。

0 Karma

tonakano
Engager

ありがとうございます。

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...