Splunk Search

Same Column Value Difference

Contributor
C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86

how to find difference in values of C2 for every same C1 value

Tags (1)
0 Karma
1 Solution

Champion

Hi

Try this

source="diff.csv" host="ind1" sourcetype="csv" 
| table C1 C2 
| sort C1 
| stats values(C2) as C2 by C1 
| eval num1 = mvindex(C2,0) 
| eval num2 = mvindex(C2,1) 
| eval diff = num2-num1 
| table C1,C2,diff

View solution in original post

0 Karma

Champion

Hi

Try this

source="diff.csv" host="ind1" sourcetype="csv" 
| table C1 C2 
| sort C1 
| stats values(C2) as C2 by C1 
| eval num1 = mvindex(C2,0) 
| eval num2 = mvindex(C2,1) 
| eval diff = num2-num1 
| table C1,C2,diff

View solution in original post

0 Karma

Contributor

It worked!!!

Thank you !!!.. but what if there are multiple As Bs Cs and Ds
As of now this solution is perfect for 2 same values.

0 Karma

Contributor

@vnravikumar can we make a generic solution ?

0 Karma

Contributor

@Vijeta @jnudell_2 You around folks ?

0 Karma

Contributor

@Vijeta Please guide.

0 Karma

Champion

Example, please

0 Karma

Contributor

It is there ..

C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86
0 Karma