Splunk Search

Subtracting column when column name are dynamic

kiamyash
Engager

Hello World.

I have a splunk search which results in the below table...

 Col1Col2Col3Col4
Row1XXXX
Row2XXXX
Row3XXXX

 

My need now is to subtract Col2 - Col1, Col3 - Col2, Col4 - Col3.

Please note the name of the column are not static, they differ depending on the search, and have the potential to be around 40 different values. 

Labels (4)

renjith_nair
Legend

@kiamyash ,

Try

 

"your current search" 
|eval _prev=0
|foreach * [eval diff_<<FIELD>> =<<FIELD>> - _prev |  eval _prev=<<FIELD>>]

 

This will create additional fields with diff as prefix.

If you dont want extra field and want to replace values in existing field, replace diff_<<FIELD>> with just <<FIELD>>

Please note , you have to use "<<FIELD>>" string. Its not the replacement of your field name

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...