I have a splunk search which results in the below table...
My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.
Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values.
"your current search"
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev | eval _prev=<<FIELD>>]
This will create additional fields with diff as prefix.
If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>
Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name