Splunk Search

How do I move all values from column one row up?

nmsaraujo
Explorer

Hello everyone,

Can not find how I may move all values from a column(Total), one row up, in a table

 

This is my current scenario

Day Total
Monday  
Tuesday 2
Wednesday 3
Thursday 4
Friday 5
Saturday 6
Sunday 7

 

This is my desired scenario:

Day Total
Monday 2
Tuesday 3
Wednesday 4
Thursday 5
Friday 6
Saturday 7
Sunday  

 

Can anyone help me please?

Thanks in advance

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The delta command calculates the difference between the value of a field in the current event and the value of the same field in the previous event.  Since the first result has no previous event, the delta is undefined (null).  

One workaround may be to reverse the events, compute the delta, then reverse everything back.

index=_internal sourcetype=scheduler
| head 10
| reverse
| delta _time as time_delta
| reverse
| fillnull value="need to move next values here" time_delta
| table _time time_delta
---
If this reply helps you, Karma would be appreciated.
0 Karma

nmsaraujo
Explorer

Thanks once more @richgalloway , but what I am looking for is really to write the values in a different row. This doesn't worked for what I am looking for.

 

I am looking to see if I can do it with mvindex.

 

Cheers

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share the query that produced that table so we help you determine why totals are in the wrong place.  There is no "move up" command in SPL.

---
If this reply helps you, Karma would be appreciated.
0 Karma

nmsaraujo
Explorer

Thanks for the quick reply @richgalloway

I am trying to make something similar to this:

index=_internal sourcetype=scheduler
| head 10
| delta _time as time_delta
| fillnull value="need to move next values here" time_delta
| table _time time_delta

 

Does this help?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...