Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Same Column Value Difference
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:16 AM
C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
how to find difference in values of C2 for every same C1 value
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnravikumar
Champion
07-25-2019
07:31 AM
Hi
Try this
source="diff.csv" host="ind1" sourcetype="csv"
| table C1 C2
| sort C1
| stats values(C2) as C2 by C1
| eval num1 = mvindex(C2,0)
| eval num2 = mvindex(C2,1)
| eval diff = num2-num1
| table C1,C2,diff
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnravikumar
Champion
07-25-2019
07:31 AM
Hi
Try this
source="diff.csv" host="ind1" sourcetype="csv"
| table C1 C2
| sort C1
| stats values(C2) as C2 by C1
| eval num1 = mvindex(C2,0)
| eval num2 = mvindex(C2,1)
| eval diff = num2-num1
| table C1,C2,diff
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:37 AM
It worked!!!
Thank you !!!.. but what if there are multiple As Bs Cs and Ds
As of now this solution is perfect for 2 same values.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:39 AM
@vnravikumar can we make a generic solution ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
08:01 AM
@Vijeta @jnudell_2 You around folks ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
09:42 AM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:16 AM
@Vijeta Please guide.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
vnravikumar
Champion
07-25-2019
07:19 AM
Example, please
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
reverse
Contributor
07-25-2019
07:21 AM
It is there ..
C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
Got questions? Get answers!
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Meet up IRL or virtually!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Get Updates on the Splunk Community!
Splunk Asynchronous Forwarding Explained
Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...
55 Days to Go: Secure Your Seat at Splunk University in Denver
Your .conf26 Experience Starts Before Opening Keynote
If Denver is known for its mile-high elevation, Splunk ...
(re)Introducing the Splunk Community Champions + 2026 – 2027 Splunk MVPs ...
This program exists as a channel to empower and recognize Splunk advocates and help supercharge initiatives to ...
