Splunk Search

eval with dynamic column names

mschellhouse
Path Finder

I have a table of data as follows:
KPI / Base:(date1) / Test:(date1) / Test:(date2) / Test:(daten)
KPI1 / 1.5 / 1.8 / 1.2 / 1.7
KPI2 / 2.1 / 2.5 / 1.9 / 2.2

I need to be able to calculate the difference between each test column to base column using eval. The test column name is dynamic as it has the date that the test was executed.

How do I handle the fact that the test column names are dynamic? They will all contain Test, or some other consistent string.

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your current search giving table in your ques
| rename Base* as Base
| foreach Test* [| eval "diff_<<MATCHSTR>>"=Base-'<<FIELD>>']

View solution in original post

somesoni2
Revered Legend

Try something like this

your current search giving table in your ques
| rename Base* as Base
| foreach Test* [| eval "diff_<<MATCHSTR>>"=Base-'<<FIELD>>']

mschellhouse
Path Finder

The rename didn't work but I got around that. The foreach and eval were very helpful. Thanks!

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...