I managed to create a table that somewhat looks like this:
However, when I tried to append a new column with the differences between after and before as its value, it just gave me a blank space. I used eval differences=after-before
which apparently doesn't work. Is there some other workaround on this? I need to get the list of differences so the end result should look something like below:
I need to have that column so I can process the average, min, and max difference for each name1, name2, etc.
Thanks!
See answer by @sundareshr but also tack on this:
... | stats list(before) AS before list(after) AS after list(diff) AS diff BY names
Try this
.. | eval z=mvzip(before, after, "@") | mvexpand z | rex field=z "(?<before>.*)@(?<after>.*)" | table names, before, after | eval diff=after-before