Hello everyone,
Can not find how I may move all values from a column(Total), one row up, in a table
This is my current scenario
Day | Total |
Monday | |
Tuesday | 2 |
Wednesday | 3 |
Thursday | 4 |
Friday | 5 |
Saturday | 6 |
Sunday | 7 |
This is my desired scenario:
Day | Total |
Monday | 2 |
Tuesday | 3 |
Wednesday | 4 |
Thursday | 5 |
Friday | 6 |
Saturday | 7 |
Sunday |
Can anyone help me please?
Thanks in advance
The delta command calculates the difference between the value of a field in the current event and the value of the same field in the previous event. Since the first result has no previous event, the delta is undefined (null).
One workaround may be to reverse the events, compute the delta, then reverse everything back.
index=_internal sourcetype=scheduler
| head 10
| reverse
| delta _time as time_delta
| reverse
| fillnull value="need to move next values here" time_delta
| table _time time_delta
Thanks once more @richgalloway , but what I am looking for is really to write the values in a different row. This doesn't worked for what I am looking for.
I am looking to see if I can do it with mvindex.
Cheers
Please share the query that produced that table so we help you determine why totals are in the wrong place. There is no "move up" command in SPL.
Thanks for the quick reply @richgalloway
I am trying to make something similar to this:
index=_internal sourcetype=scheduler
| head 10
| delta _time as time_delta
| fillnull value="need to move next values here" time_delta
| table _time time_delta
Does this help?