Splunk 640: How to eval the difference between events' values

[htkwan]

Hello Everybody,
I've a table (w/o the yellow column), as shown below. I want to eval another field (in yellow). It shows the difference between the LatestValue, by Category2, TagName, FiscalDate (number). Pls. advise. Thanks.

[sundareshr]

You could do as @javiergn suggested (set Diff to "" if negative). The risk with that if there are negative Diffs within a tag, you would lose those. Another option would be to use streamstats and group by tag. Like this

your search here | streamstats window=1 current=f first(LatestValue) as NextValue by TagName | eval Diff=LatestValue-NextValue

[javiergn]

You want to use delta:

your search here
| delta LatestValue as Diff p=1

By the way, make sure your events are sorted first. For instance:

your search here
| sort FiscalDate
| delta LatestValue as Diff p=1

If you need something more granular, such as only sum those where category and tag match then you can use streamstats probably or maybe just sort by FiscalDate, Category2, TagName.

Let me know if the above works for you anyway

[htkwan]

Hello Javiergn,
It works partially. See below.

It should be as below.

[javiergn]

If you don't want the negative numbers then simply append the following to your search:

| eval Diff = if (Diff < 0, "", Diff)