Hello World.
I have a splunk search which results in the below table...
Col1 | Col2 | Col3 | Col4 | |
Row1 | X | X | X | X |
Row2 | X | X | X | X |
Row3 | X | X | X | X |
My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.
Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values.
Try
"your current search"
|eval _prev=0
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev | eval _prev=<<FIELD>>]
This will create additional fields with diff as prefix.
If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>
Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name