Reporting

Calculate Difference Between Same Field in Different Rows

he204035
Explorer

If I have the following table using columns DATE and USAGE, is there a way to create a 3rd column to display the difference in the USAGE column from Day X to previous day?

 

DATE USAGE

Feb-28
Feb-29
Mar-01
Mar-02
Mar-03
Mar-04
Mar-05
Mar-06
Mar-07
Mar-08
Mar-09
Mar-10
Mar-11
Mar-12
17.68 gb
18.53 gb
19.66 gb
21.09 gb
22.04 gb
23.21 gb
24.20 gb
24.94 gb
25.64 gb
26.80 gb
27.79 gb
29.07 gb
30.09 gb
31.01 gb
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming these are numeric (not strings), you can use streamstats

| streamstats window=2 range(USAGE) as difference
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...