Generic Solution to Same Column Value Difference

[reverse]

What would be the best generic solution to

https://answers.splunk.com/answers/760677/same-column-value-difference.html?minQuestionBodyLength=80

what if there are multiple As Bs Cs and Ds. As of now mentioned solution is perfect for just 2 same corresponding values.

[woodcock · Accepted solution]

Like this:

| makeresults 
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12 
    [eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
  | eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")

[reverse]

THANK YOU !!!!!

[jnudell_2]

Be a little bit more specific. If you have three values for C1=A of 10, 4, 5. What would you consider the difference? Difference only works for two values. Unless you mean the difference of the most recent value, minus all previous values (Ie; 10 - 4 - 5 = 1).

C1  C2
---------- 
A   10
A   4
A   5

What would you consider the "difference" for the above?

[reverse]

2nd index value - 1st index value
3rd index value - 2nd index value

basically 0->n
n- (n+1)
where n is the mv index

 C1  C2
 ---------- 
 A   10
 A   4
 A   5

in this example

diff will be -6 and 1

[reverse]

@Vijeta Please visit here.

[reverse]

@Vijeta @jnudell_2 Please guide.