Splunk Search

How do I move all values from column one row up?

nmsaraujo
Explorer

Hello everyone,

Can not find how I may move all values from a column(Total), one row up, in a table

 

This is my current scenario

Day Total
Monday  
Tuesday 2
Wednesday 3
Thursday 4
Friday 5
Saturday 6
Sunday 7

 

This is my desired scenario:

Day Total
Monday 2
Tuesday 3
Wednesday 4
Thursday 5
Friday 6
Saturday 7
Sunday  

 

Can anyone help me please?

Thanks in advance

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The delta command calculates the difference between the value of a field in the current event and the value of the same field in the previous event.  Since the first result has no previous event, the delta is undefined (null).  

One workaround may be to reverse the events, compute the delta, then reverse everything back.

index=_internal sourcetype=scheduler
| head 10
| reverse
| delta _time as time_delta
| reverse
| fillnull value="need to move next values here" time_delta
| table _time time_delta
---
If this reply helps you, Karma would be appreciated.
0 Karma

nmsaraujo
Explorer

Thanks once more @richgalloway , but what I am looking for is really to write the values in a different row. This doesn't worked for what I am looking for.

 

I am looking to see if I can do it with mvindex.

 

Cheers

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the query that produced that table so we help you determine why totals are in the wrong place.  There is no "move up" command in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

nmsaraujo
Explorer

Thanks for the quick reply @richgalloway

I am trying to make something similar to this:

index=_internal sourcetype=scheduler
| head 10
| delta _time as time_delta
| fillnull value="need to move next values here" time_delta
| table _time time_delta

 

Does this help?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...