Splunk Search

Column value differences

Chinmai
Explorer

Hello Guys,

I have columns like column1, coulmn2, column3... and I want output as column1, column2=column2-column1, column3=column3-column2, col4=col4-col3...

Is there any way to write search query for this?

Thanks in advance.

Tags (1)
0 Karma

Chinmai
Explorer

Hello All,

Thanks for your answers, but the columns number is more. I cannot do colY=colY-colX every time, is there any better solution?

I have around 20-30 rows as output and other than columns col1,col2,col3.. I have another one column which I am using in my by clause of search query

0 Karma

somesoni2
Revered Legend

How many rows do you get? Do you have other columns as well other than columnNs where N=1,2,3...?

0 Karma

adonio
Ultra Champion

use the eval command / function
... | eval newColumn = columnX - columnY
more on this topic here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

0 Karma

maffreitas
Path Finder

Hi, you can thy this:

index=xpto source=abc | eval column2a = column2 - column1, column3a = column3 - column2 | table column2a, column3a

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...