What would be the best generic solution to
https://answers.splunk.com/answers/760677/same-column-value-difference.html?minQuestionBodyLength=80
what if there are multiple As Bs Cs and Ds. As of now mentioned solution is perfect for just 2 same corresponding values.
Like this:
| makeresults
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12
[eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
| eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")
Like this:
| makeresults
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12
[eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
| eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")
THANK YOU !!!!!
Be a little bit more specific. If you have three values for C1=A of 10, 4, 5. What would you consider the difference? Difference only works for two values. Unless you mean the difference of the most recent value, minus all previous values (Ie; 10 - 4 - 5 = 1).
C1 C2
----------
A 10
A 4
A 5
What would you consider the "difference" for the above?
2nd index value - 1st index value
3rd index value - 2nd index value
basically 0->n
n- (n+1)
where n is the mv index
C1 C2
----------
A 10
A 4
A 5
in this example
diff will be -6 and 1
@Vijeta Please visit here.
@Vijeta @jnudell_2 Please guide.