Splunk Search

Subtracting column when column name are dynamic

kiamyash
Engager

Hello World.

I have a splunk search which results in the below table...

 Col1Col2Col3Col4
Row1XXXX
Row2XXXX
Row3XXXX

 

My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.

Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values. 

Labels (4)

renjith_nair
SplunkTrust
SplunkTrust

@kiamyash ,

Try

 

"your current search" 
|eval _prev=0
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev |  eval _prev=<<FIELD>>]

 

This will create additional fields with diff as prefix.

If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>

Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name

 

Happy Splunking!
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...