Splunk Search

Subtracting column when column name are dynamic

kiamyash
Engager

Hello World.

I have a splunk search which results in the below table...

 Col1Col2Col3Col4
Row1XXXX
Row2XXXX
Row3XXXX

 

My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.

Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values. 

Labels (4)

renjith_nair
SplunkTrust
SplunkTrust

@kiamyash ,

Try

 

"your current search" 
|eval _prev=0
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev |  eval _prev=<<FIELD>>]

 

This will create additional fields with diff as prefix.

If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>

Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name

 

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.