Splunk Search

## Same Column Value Difference

Contributor
``````C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
``````

how to find difference in values of C2 for every same C1 value

Tags (1)
1 Solution
Champion

Hi

Try this

``````source="diff.csv" host="ind1" sourcetype="csv"
| table C1 C2
| sort C1
| stats values(C2) as C2 by C1
| eval num1 = mvindex(C2,0)
| eval num2 = mvindex(C2,1)
| eval diff = num2-num1
| table C1,C2,diff
``````
Champion

Hi

Try this

``````source="diff.csv" host="ind1" sourcetype="csv"
| table C1 C2
| sort C1
| stats values(C2) as C2 by C1
| eval num1 = mvindex(C2,0)
| eval num2 = mvindex(C2,1)
| eval diff = num2-num1
| table C1,C2,diff
``````
Contributor

It worked!!!

Thank you !!!.. but what if there are multiple As Bs Cs and Ds
As of now this solution is perfect for 2 same values.

Contributor

@vnravikumar can we make a generic solution ?

Contributor

@Vijeta @jnudell_2 You around folks ?

Contributor
Contributor

Champion

Contributor

It is there ..

``````C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
``````