I am trying to find a way to compare the results listed in a table to each other.  Basically the table lists the results of many different test where some test have the same names, but have been run and rerun so they have same test_names but different test_IDs. something like this test_name test_id Score Drift test 1 .98 100   test 1 .99 98 -2 test 1 1.00 100 2 test 2  .01 30   test 3 0.54 34   test 3 0.55 76 42    I am looking for a way to take the score from line one and have some sort of logic that will look at the result of the next line and if the test has the sane test_name BUT a different test_ID it will subtract the first lines score from the second lines score and continue along until the (for example) the next line has a different test_name and it skips the line until it finds another line where the following line have the same test_name. and it continues on until all scores are compared.  The delta command almost works but I need to have the ability to say BY test_name  something like      | delta Score as Drift by test_name     unfortunately delta doesn't accept by clauses I am trying to find a way to calculate the drift column using Splunk so I can create a detection where the drift exceeds a specific threshold.    ... View more