Splunk Search

how to move a value into adjacent row

crmarley20
Explorer

Hello,

I have a condition when the variable new_tag of the previous row is equal to 1 and the variable test_tag of the current row is equal to 1 I must subtract the start value of the previous row with the start value of the current row.

I want the result of the subtraction to be written in the previous row in the result column.

Unfortunately I could only get this subtraction to be written to the current row in the result column.

Please could someone help me, thank you very much.

crmarley20_0-1643716867622.png

 

Labels (7)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| reverse
| streamstats window=2 first(result) as result
| reverse

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| reverse
| streamstats window=2 first(result) as result
| reverse
0 Karma

crmarley20
Explorer

Thank you very much!

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...