Splunk Search

I have to find difference between alternate rows for a field like Row 2-1, Row 4-3. Not difference between all the consecutive rows. I used "diff" but it gives me difference between all the rows. Please suggest.

Engager

TXName Period Value diffValue
tx1 Period 1 25

tx1 Period 2 14 -11
tx2 Period 1 12
tx2 Period 2 20 8

Tags (2)

SplunkTrust
SplunkTrust

Streamstats is your friend here.
This is what I would do:

| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)

Example (mycsv.csv contains the table you mentioned in your question):

| inputcsv mycsv.csv 
| streamstats count as ID by TXName
| sort -limit=0 -ID
| eval ValueForDiff = if(ID=1, -Value, Value)
| eventstats sum(ValueForDiff) as DiffValue by TXName
| eval DiffValue = if(ID=1, null(), DiffValue)
| table TXName, Period, Value, DiffValue
| sort -limit=0 TXName, Period

Output (see picture):

alt text

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!