Splunk Search

How to subtract field values and have the result in a new field?

russell120
Communicator

Hi, please view my example csv.

file1.csv:

Apples  Bananas    Oranges    Grapes
50        44         83         121

I would like a new column that would show the difference in each field from left to right so that the table would then look like this:

Apples  Bananas    Oranges    Grapes    Delta
50        44         83         121       6 
                                         39
                                         38

What SPL could I use to accomplish this?? In the end, I intend to display the values in the Delta field as a line graph visualization across the values of the fruit while they're displayed as a bar graph. I know it doesn't make much sense logically but work with me here lol.

1 Solution

renjith_nair
Legend

@russell120,

If you have defined number of columns, then try

"your search" |eval Delta=abs(Apples-Bananas)."#".abs(Bananas-Oranges)."#".abs(Oranges-Grapes)|makemv delim="#" Delta
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@russell120,

If you have defined number of columns, then try

"your search" |eval Delta=abs(Apples-Bananas)."#".abs(Bananas-Oranges)."#".abs(Oranges-Grapes)|makemv delim="#" Delta
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

harishalipaka
Motivator

hi @russell120

can u try like this

|makeresults |eval  Apples=50,Bananas=44,Oranges=83,Grapes=121 |table  Apples Bananas Oranges Grapes|transpose |delta "row 1" as delta|transpose header_field=column |fields - column
Thanks
Harish
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...