Splunk Search

Splunk Query Help ??

rakesh_498115
Motivator

Hi i have obtained the following stats from my query ..Here the list of stats i got my from query..

A
1
3
4
6
8
Now on these stats , i need to get one more column say B..which should the contain the values..like this..

i.e in B column first column must have differnce of A 2ndcolum and A 1stcolumn
similary it has get for all the values..

ie B1=(A2-A1)
B2=(A3-A2)...

so at last i need the stats like this..

A B
1 2 (A2-A1)
3 1 (A3-A2)
4 2 (A4-A3)
6 2 (A5-A4)
8 -7 (A1-A5)

Please Help ..

Tags (1)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

Does the delta command do what you need?

View solution in original post

dart
Splunk Employee
Splunk Employee

Does the delta command do what you need?

rakesh_498115
Motivator

A B

2 1
3 1
4 1
6 2

this is final table where set A is obtained from my search query

0 Karma

dart
Splunk Employee
Splunk Employee

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

0 Karma

rakesh_498115
Motivator

yeah..

Consider this the column.

A B

2 1

3 1
4 1
6 2

here in B column first value is the avg of all the three values .. ie (1+1+2)/4=1

i have got the these three values using delta command ..

|delta A as B p=1

but i need to replace the first value with the avg of remaing values..??
please help

0 Karma

dart
Splunk Employee
Splunk Employee

I'm not sure I understand your desired final product. Can you draw a table illustrating this?

0 Karma

rakesh_498115
Motivator

Yeah exactly thanx..now can i get the avg of all the values in the list and update this value in the first column of the same list...??

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...