Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Same Column Value Difference
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:16 AM
C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
how to find difference in values of C2 for every same C1 value
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnravikumar
Champion
07-25-2019
07:31 AM
Hi
Try this
source="diff.csv" host="ind1" sourcetype="csv"
| table C1 C2
| sort C1
| stats values(C2) as C2 by C1
| eval num1 = mvindex(C2,0)
| eval num2 = mvindex(C2,1)
| eval diff = num2-num1
| table C1,C2,diff
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnravikumar
Champion
07-25-2019
07:31 AM
Hi
Try this
source="diff.csv" host="ind1" sourcetype="csv"
| table C1 C2
| sort C1
| stats values(C2) as C2 by C1
| eval num1 = mvindex(C2,0)
| eval num2 = mvindex(C2,1)
| eval diff = num2-num1
| table C1,C2,diff
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:37 AM
It worked!!!
Thank you !!!.. but what if there are multiple As Bs Cs and Ds
As of now this solution is perfect for 2 same values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:39 AM
@vnravikumar can we make a generic solution ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
08:01 AM
@Vijeta @jnudell_2 You around folks ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
09:42 AM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:16 AM
@Vijeta Please guide.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnravikumar
Champion
07-25-2019
07:19 AM
Example, please
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:21 AM
It is there ..
C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
Got questions? Get answers!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Meet up IRL or virtually!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Related Topics
Get Updates on the Splunk Community!
Announcing Modern Navigation: A New Era of Splunk User Experience
We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...
How Edge Processor's Durable Queue Works
Edge Processor sits in one of the most consequential places in any Splunk pipeline: between your data sources ...
Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights
Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...
