Hi, have SPL that generates months of data. I want subtract just the last two columns. The fields will change month to month, so I can't hard code.
Given the below sample, how can I get lastMonthDiff without hardcoding the field values? Thank you! Chris
| makeresults
| eval "2202-01"=1
| eval "2202-02"=2
| eval "2202-03"=5
| eval "2202-04"=4
| append
[| makeresults
| eval "2202-01"=4
| eval "2202-02"=5
| eval "2202-03"=7
| eval "2202-04"=3
]
| append
[| makeresults
| eval "2202-01"=5
| eval "2202-02"=2
| eval "2202-03"=7
| eval "2202-04"=9
]
| fields - _time |foreach * [eval lastMonthDiff = '2202-03' - '2202-04']
| foreach *
[| eval diff=if(isnull(previous),null(),previous-'<<FIELD>>')
| eval previous='<<FIELD>>']
| foreach *
[| eval diff=if(isnull(previous),null(),previous-'<<FIELD>>')
| eval previous='<<FIELD>>']
Awesome, thank you!