Create multiple eval fields with wilcards?

[jweinstein]

I'm attempting to calculate the deltas between a field and it's historical value. I use a subquery w/ appendcols to return the historical data and it is nicely in the form:

Group, field1, field2, field1_historical, field2_historical

I can create the deltas with:

 | eval field1_delta = field1 - field1_historical
 | eval field2_delta = field2 - field2_historical

This works but I'd like to generalize it:

| eval *_delta = * - *_historical 

but I get the error:

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '* - *_historical'.

Any tips?

[gkanapathy]

Sorry, no. You'll just have to type it out. You can try using a macro to shorten your typing, but you're still going to have to specify the field base names.

[dwaddle]

sbsbb, if this is something you need make sure your file an enhancement request about it.

[sbsbb]

I need this function too, hopefully it will come with next release of splunk

[martin_mueller]

An alternative to typing them out, especially if the field names are dynamic, would be to write your own search command to do this task.