Splunk Search

Subtracting column when column name are dynamic

kiamyash
Engager

Hello World.

I have a splunk search which results in the below table...

 Col1Col2Col3Col4
Row1XXXX
Row2XXXX
Row3XXXX

 

My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.

Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values. 

Labels (4)

renjith_nair
SplunkTrust
SplunkTrust

@kiamyash ,

Try

 

"your current search" 
|eval _prev=0
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev |  eval _prev=<<FIELD>>]

 

This will create additional fields with diff as prefix.

If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>

Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name

 

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!