Splunk Search

How to calculate changes over multiple column

jgcsco
Path Finder

I have the following output from my base search:

alt text

It shows accumulative value for each sampling time for each interface. Is there a good way to calculate the change for each sampling time for each interface and show the result in a similar table format?

Thanks

0 Karma

cmerriman
Super Champion

you can use a streamstats command.

|streamstats window=1 current=f values(*) as prev*|foreach TenGig* [eval diff_<<FIELD>>='<<FIELD>>'-prev<<MATCHSTR>>]

http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Foreach

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...