Splunk Search

## Generic Solution to Same Column Value Difference

Contributor

What would be the best generic solution to

what if there are multiple As Bs Cs and Ds. As of now mentioned solution is perfect for just 2 same corresponding values.

Tags (1)
1 Solution
Esteemed Legend

Like this:

| makeresults
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12
[eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
| eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")
Esteemed Legend

Like this:

| makeresults
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12
[eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
| eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")
Contributor

THANK YOU !!!!!

Builder

Be a little bit more specific. If you have three values for C1=A of 10, 4, 5. What would you consider the difference? Difference only works for two values. Unless you mean the difference of the most recent value, minus all previous values (Ie; 10 - 4 - 5 = 1).

C1  C2
----------
A   10
A   4
A   5

What would you consider the "difference" for the above?

Contributor

2nd index value - 1st index value
3rd index value - 2nd index value

basically 0->n
n- (n+1)
where n is the mv index

C1  C2
----------
A   10
A   4
A   5

in this example

diff will be -6 and 1

Contributor