Splunk Query Help ??

[rakesh_498115]

Hi i have obtained the following stats from my query ..Here the list of stats i got my from query..

A
1
3
4
6
8
Now on these stats , i need to get one more column say B..which should the contain the values..like this..

i.e in B column first column must have differnce of A 2ndcolum and A 1stcolumn
similary it has get for all the values..

ie B1=(A2-A1)
B2=(A3-A2)...

so at last i need the stats like this..

A B
1 2 (A2-A1)
3 1 (A3-A2)
4 2 (A4-A3)
6 2 (A5-A4)
8 -7 (A1-A5)

Please Help ..

[dart · Accepted solution]

Does the delta command do what you need?

[rakesh_498115]

A B

2 1
3 1
4 1
6 2

this is final table where set A is obtained from my search query

[dart]

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

[rakesh_498115]

yeah..

Consider this the column.

A B

2 1

3 1
4 1
6 2

here in B column first value is the avg of all the three values .. ie (1+1+2)/4=1

i have got the these three values using delta command ..

|delta A as B p=1

but i need to replace the first value with the avg of remaing values..??
please help

[dart]

I'm not sure I understand your desired final product. Can you draw a table illustrating this?

[rakesh_498115]

Yeah exactly thanx..now can i get the avg of all the values in the list and update this value in the first column of the same list...??