Splunk Search

How do I move results retrieved by the "delta" command one row up?

j_r
Path Finder

Is it possible to move the results of "delta" one row up?

I calculate time difference with "delta" and would like to move the column with the results one row up

0 Karma
1 Solution

whrg
Motivator

Hello @j_r,

I could find a similar question here: How do I store the delta value in the previous row.

So the idea is to reverse the sort order, then calculate the delta, then reverse the sign and then reverse again:

your base search
| reverse | delta yourfield as yourfield_diff | eval yourfield_diff=0-yourfield_diff | reverse

Instead of "reverse" you could also use "sort _time" and "sort -_time".

View solution in original post

0 Karma

whrg
Motivator

Hello @j_r,

I could find a similar question here: How do I store the delta value in the previous row.

So the idea is to reverse the sort order, then calculate the delta, then reverse the sign and then reverse again:

your base search
| reverse | delta yourfield as yourfield_diff | eval yourfield_diff=0-yourfield_diff | reverse

Instead of "reverse" you could also use "sort _time" and "sort -_time".

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!