- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
akhera
New Member
10-16-2018
04:36 AM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

renjith_nair
Legend
10-16-2018
07:36 AM
@akhera,
Try this,
your search|streamstats current=f window=1 last(Column1) as prev|eval rowno=1|accum rowno
|eval Total=if(rowno%2==0,Column1+prev,null())|fields - rowno,prev
You shall change the logic to display data in alternative columns if needed
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
mstjohn_splunk

Splunk Employee
10-18-2018
09:17 AM
Hi @akhera,
Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
akhera
New Member
10-24-2018
01:36 AM
@mstjohn_splunk @renjith.nair This is really helpful and it solved my issue. thanks for your help and support.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

renjith_nair
Legend
10-16-2018
07:36 AM
@akhera,
Try this,
your search|streamstats current=f window=1 last(Column1) as prev|eval rowno=1|accum rowno
|eval Total=if(rowno%2==0,Column1+prev,null())|fields - rowno,prev
You shall change the logic to display data in alternative columns if needed
---
What goes around comes around. If it helps, hit it with Karma 🙂
What goes around comes around. If it helps, hit it with Karma 🙂
