Splunk Search

## Generic Solution to Same Column Value Difference

Contributor

What would be the best generic solution to

``````https://answers.splunk.com/answers/760677/same-column-value-difference.html?minQuestionBodyLength=80
``````

what if there are multiple As Bs Cs and Ds. As of now mentioned solution is perfect for just 2 same corresponding values.

Tags (1)
1 Solution
Esteemed Legend

Like this:

``````| makeresults
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12
[eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
| eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")
``````
Esteemed Legend

Like this:

``````| makeresults
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12
[eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
| eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")
``````
Contributor

THANK YOU !!!!!

Builder

Be a little bit more specific. If you have three values for C1=A of 10, 4, 5. What would you consider the difference? Difference only works for two values. Unless you mean the difference of the most recent value, minus all previous values (Ie; 10 - 4 - 5 = 1).

``````C1  C2
----------
A   10
A   4
A   5
``````

What would you consider the "difference" for the above?

Contributor

2nd index value - 1st index value
3rd index value - 2nd index value

basically 0->n
n- (n+1)
where n is the mv index

`````` C1  C2
----------
A   10
A   4
A   5
``````

in this example

diff will be -6 and 1

Contributor  