Hello, I'm having trouble figuring out how to use foreach + eval getting the difference of the fields. I have something like this:    You can use this search to obtained the above result:    | makeresults | eval Country="PH" | eval "2020-01 Actual"=1 | eval "2020-01 Forecast"=2 | eval "2020-02 Actual"=5 | eval "2020-02 Forecast"=4 | eval "2020-03 Actual"=50 | eval "2020-03 Forecast"=20 | append [| makeresults | eval Country="IND" | eval "2020-01 Actual"=3 | eval "2020-01 Forecast"=3 | eval "2020-02 Actual"=2 | eval "2020-02 Forecast"=2 | eval "2020-03 Actual"=40 | eval "2020-03 Forecast"=23 ] | append [| makeresults | eval Country="SG" | eval "2020-01 Actual"=2 | eval "2020-01 Forecast"=4 | eval "2020-02 Actual"=1 | eval "2020-02 Forecast"=9 | eval "2020-03 Actual"=30 | eval "2020-03 Forecast"=53 ] | fields - _time   And I'm trying to use foreach/eval to get this:   Thanks in advance 🙂  ... View more

Im kinda newbie here in splunk. Whats the difference between multivalue and transpose command? how can i convert this input to this desired output? (see tables below) Is Multivalue or transpose command can manage this? For a newbie like me those commands is kinda tricky. Many thanks in advance   input: Field1 Field2 Country 1-Jun 1-Jul 1-Aug 1-Sep 1-Oct X AB Thailand 23 2343 31 1 1 Y CD Singapore 2 321 2 52 22 Z EF Philippines 31 56 43 84 23   output: Field1 Field2 Country Month Value X AB Thailand 1-Jun 23 X AB Thailand 1-Jul 2343 X AB Thailand 1-Aug 31 X AB Thailand 1-Sep 1 X AB Thailand 1-Oct  1 Y CD Singapore 1-Jun 2 Y CD Singapore 1-Jul 321 Y CD Singapore 1-Aug 2 Y CD Singapore 1-Sep 52 Y CD Singapore 1-Oct  22 Z EF Philippines 1-Jun 31 Z EF Philippines 1-Jul 56 Z EF Philippines 1-Aug 43 Z EF Philippines 1-Sep 84 Z EF Philippines 1-Oct  23 ... View more