Splunk Search

playing with data II

reverse
Contributor

q1- how can i get c4 where c4 will always be difference of values in c3 against first of c2 - next of c2
for example .. here c4 for A = 76-7 .. 7-6 ... 6-677.. and so on

Please guide.

c1  c2  c3
A   1   76
A   2   7
A   3   6
A   4   677
B   1   65
B   2   675
B   3   90
B   4   78
C   1   121
C   2   56
C   3   54
C   4   67
D   1   56
D   2   6
D   3   5
D   4   657
Tags (1)
0 Karma

reverse
Contributor

@Vijeta please guide.

0 Karma

Vijeta
Influencer

@reverse Try this

<your query> | sort c1,c2|streamstats list(c3) as list , count as count by c1| eval diff  = mvindex(list, count-2)| eval c4= c3 - diff
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...