Subtracting column when column name are dynamic

[kiamyash]

Hello World.

I have a splunk search which results in the below table...

	Col1	Col2	Col3	Col4
Row1	X	X	X	X
Row2	X	X	X	X
Row3	X	X	X	X

My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.

Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values. 

[renjith_nair]

@kiamyash ,

Try

"your current search" 
|eval _prev=0
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev |  eval _prev=<<FIELD>>]

This will create additional fields with diff as prefix.

If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>

Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name