How to display the value of the difference result in Splunk?

[vdalvi]

Hi,

How can I display the actual value of the difference in a new column? The value is "cts16k1sacc".
Row 1 in attached screenshot....

I want to be able to display the actual value of my cmtsID besides the difference column for example column name "Added" or "Removed" to reflect the Difference numeric value

[richgalloway]

Please use more words to describe your problem. The screen shot shows a "difference" column already and doesn't have "cts16k1sacc" in it.

[vdalvi]

Hi Rich, not sure why my original post didnt allow me to write a long post.

So yes as we see in row 1 the Difference of Today - Yesterday = 1. In my splunk search logs it reflects to a value of "cts16k1sacc" which was received new today. I wanted to check how can I display the actual values in a new column besides the calculated difference i.e "cts16k1sacc". So I can look at the table and say it was new value today. I plan to implement this on a much larger scale but started small with just first row for now...

[richgalloway]

Please share your search and some sample data so we can see how the results are produced.

[vdalvi]

HI Rich,

Below is search output

Enabled Today Yesterday Difference
0.0 7 17 -10
1.0 3547 3749 -202

I would like to see the values that "10" and "202" correspond to in a new column say Added and Removed (since above are negative drop from yesterday they would be under Removed)

Below is the sample event output as well

6/4/20
7:39:52.000 AM

2020-06-04 07:39:52 [properties-data-container-10-C-1] INFO c.s.n.n.consumer.Receiver - topicName = properties.cmts, fqdn = mailhi0101m.hawaii.rr.com , enabled = 0.0
host = * source = /var/notes/noc/noc-properties-consumer.logsourcetype = noc-data-consumertopicName = properties.cmts

6/4/20
7:39:52.000 AM

2020-06-04 07:39:52 [properties-data-container-1-C-1] INFO c.s.n.n.consumer.Receiver - topicName = properties.cmts, fqdn = mailhi0102m.hawaii.rr.com , enabled = 0.0
host = * source = /var/notes/noc/noc-properties-consumer.logsourcetype = noc-data-consumertopicName = properties.cmts

I would like to see the value of fqdn in the Added or Removed Column as its unique and will tell me new fqdn Added or Removed