Splunk Search

Splunk Query Help ??

Motivator

Hi i have obtained the following stats from my query ..Here the list of stats i got my from query..

A
1
3
4
6
8
Now on these stats , i need to get one more column say B..which should the contain the values..like this..

i.e in B column first column must have differnce of A 2ndcolum and A 1stcolumn
similary it has get for all the values..

ie B1=(A2-A1)
B2=(A3-A2)...

so at last i need the stats like this..

A B
1 2 (A2-A1)
3 1 (A3-A2)
4 2 (A4-A3)
6 2 (A5-A4)
8 -7 (A1-A5)

Please Help ..

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Does the delta command do what you need?

View solution in original post

Splunk Employee
Splunk Employee

Does the delta command do what you need?

View solution in original post

Motivator

A B

2 1
3 1
4 1
6 2

this is final table where set A is obtained from my search query

0 Karma

Splunk Employee
Splunk Employee

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

0 Karma

Motivator

yeah..

Consider this the column.

A B

2 1

3 1
4 1
6 2

here in B column first value is the avg of all the three values .. ie (1+1+2)/4=1

i have got the these three values using delta command ..

|delta A as B p=1

but i need to replace the first value with the avg of remaing values..??
please help

0 Karma

Splunk Employee
Splunk Employee

I'm not sure I understand your desired final product. Can you draw a table illustrating this?

0 Karma

Motivator

Yeah exactly thanx..now can i get the avg of all the values in the list and update this value in the first column of the same list...??

0 Karma