How do I move all values from column one row up?

[nmsaraujo]

Hello everyone,

Can not find how I may move all values from a column(Total), one row up, in a table

This is my current scenario

Day	Total
Monday
Tuesday	2
Wednesday	3
Thursday	4
Friday	5
Saturday	6
Sunday	7

This is my desired scenario:

Day	Total
Monday	2
Tuesday	3
Wednesday	4
Thursday	5
Friday	6
Saturday	7
Sunday

Can anyone help me please?

Thanks in advance

[richgalloway]

The delta command calculates the difference between the value of a field in the current event and the value of the same field in the previous event.  Since the first result has no previous event, the delta is undefined (null).  

One workaround may be to reverse the events, compute the delta, then reverse everything back.

index=_internal sourcetype=scheduler
| head 10
| reverse
| delta _time as time_delta
| reverse
| fillnull value="need to move next values here" time_delta
| table _time time_delta

[nmsaraujo]

Thanks once more @richgalloway , but what I am looking for is really to write the values in a different row. This doesn't worked for what I am looking for.

I am looking to see if I can do it with mvindex.

Cheers

[richgalloway]

Please share the query that produced that table so we help you determine why totals are in the wrong place.  There is no "move up" command in SPL.

[nmsaraujo]

Thanks for the quick reply @richgalloway

I am trying to make something similar to this:

index=_internal sourcetype=scheduler
| head 10
| delta _time as time_delta
| fillnull value="need to move next values here" time_delta
| table _time time_delta

Does this help?