Splunk Search

Compare the row values to the above row.

vinod743374
Communicator

Compare the row value with the above row value ,
if the above row value is grater than the  present row value, it should be replaced with the above value,
otherwise remains same.

vinod743374_0-1625974134313.png

i have a table like the above image,
you can observe date wise sum data , third row values should compare with the  second row , if it is grater than the above value it should replace with the higher value>

if anyone suggest me any other method , it would be also appreciated. 

i think you guys understand, what i requested ,

please help me out

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats max(*) as *

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Please can you clarify what would happen if a fourth row had value 4 in the second column, should this be replaced by 5 from row 3 or 7 from row 2 via row 3?

0 Karma

vinod743374
Communicator

thanks for the response ,

yeah it should replaced by 7 only ,
it should replace with the higher value in the column.

if our 4th row has the highest value , it should remains same.
the same should work for all the rows.

thank you !!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats max('Aaa Server-Arista') as "Aaa Server-Arista"
0 Karma

vinod743374
Communicator

if possible , can't we generalize the query for all the rows. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats max(*) as *

vinod743374
Communicator

It working ,
Thankyou so much !! 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@vinod743374 

Can you please try this?

Your_search
| streamstats window=2 earliest(A) as pre_A 
| eval A=if(pre_A>A,pre_A,A)

or

Your_search
| autoregress A as pre_A p=1
| eval A=if(pre_A>A,pre_A,A)

 

My Sample Search :

| makeresults | eval _raw="A	B	C
2	35	37
7	35	37
5	35	37" | multikv forceheader=1
| table _time A	B	C
| streamstats window=2 earliest(A) as pre_A 
| eval A=if(pre_A>A,pre_A,A)

 

| makeresults | eval _raw="A	B	C
2	35	37
7	35	37
5	35	37" | multikv forceheader=1
| table _time A	B	C
| autoregress A as pre_A p=1
| eval A=if(pre_A>A,pre_A,A)

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

vinod743374
Communicator

thank you for the response <

with your query,
it replaces with the  the previous value ,
but in my case , it should return when ever the value is grater than the present value, otherwise it should remain same.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...