Splunk Search

Column value differences

Chinmai
Explorer

Hello Guys,

I have columns like column1, coulmn2, column3... and I want output as column1, column2=column2-column1, column3=column3-column2, col4=col4-col3...

Is there any way to write search query for this?

Thanks in advance.

Tags (1)
0 Karma

Chinmai
Explorer

Hello All,

Thanks for your answers, but the columns number is more. I cannot do colY=colY-colX every time, is there any better solution?

I have around 20-30 rows as output and other than columns col1,col2,col3.. I have another one column which I am using in my by clause of search query

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How many rows do you get? Do you have other columns as well other than columnNs where N=1,2,3...?

0 Karma

adonio
Ultra Champion

use the eval command / function
... | eval newColumn = columnX - columnY
more on this topic here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma

maffreitas
Path Finder

Hi, you can thy this:

index=xpto source=abc | eval column2a = column2 - column1, column3a = column3 - column2 | table column2a, column3a

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...