Splunk Search

How to calculate changes over multiple column

jgcsco
Path Finder

I have the following output from my base search:

alt text

It shows accumulative value for each sampling time for each interface. Is there a good way to calculate the change for each sampling time for each interface and show the result in a similar table format?

Thanks

0 Karma

cmerriman
Super Champion

you can use a streamstats command.

|streamstats window=1 current=f values(*) as prev*|foreach TenGig* [eval diff_<<FIELD>>='<<FIELD>>'-prev<<MATCHSTR>>]

http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Foreach

Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...