Column1 Column2
28 28
46 46-28
58 58-(28+46)
89 89-(28+46+58)
Is this possible? If yes, plz suggest how to write a search for this.
Thanks,
Payal
This should do what you need:
... | streamstats sum(column1) AS cum_total | eval cum_total = cum_total - column1| eval column2 = column1 - cum_total | fields - cum_total
Explanation:
streamstats sum(column1) AS cum_total
= will calculate the cumulative total including the value of column1eval cum_total = cum_total - column1
= removes the value of column1 from the cum_totaleval column2 = column1 - cum_total
= calculates the value of column2 for youfields - cum_total
= removes the cum_total column from your resultsHope this helps
--- EDIT ---
Just had another thought. You might be able to solve this with the delta
command. Go here for details.
Maybe this will help You:
https://answers.splunk.com/answers/108120/referencing-a-the-next-line-or-previous-line.html