Splunk Search

## Splunk Query Help ??

Motivator

Hi i have obtained the following stats from my query ..Here the list of stats i got my from query..

A
1
3
4
6
8
Now on these stats , i need to get one more column say B..which should the contain the values..like this..

i.e in B column first column must have differnce of A 2ndcolum and A 1stcolumn
similary it has get for all the values..

ie B1=(A2-A1)
B2=(A3-A2)...

so at last i need the stats like this..

A B
1 2 (A2-A1)
3 1 (A3-A2)
4 2 (A4-A3)
6 2 (A5-A4)
8 -7 (A1-A5)

Tags (1)
1 Solution
Splunk Employee

Does the delta command do what you need?

Splunk Employee

Does the delta command do what you need?

Motivator

A B

2 1
3 1
4 1
6 2

this is final table where set A is obtained from my search query

Splunk Employee

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

Motivator

yeah..

Consider this the column.

A B

2 1

3 1
4 1
6 2

here in B column first value is the avg of all the three values .. ie (1+1+2)/4=1

i have got the these three values using delta command ..

|delta A as B p=1

but i need to replace the first value with the avg of remaing values..??