Splunk Search

Splunk Query Help ??

rakesh_498115
Motivator

Hi i have obtained the following stats from my query ..Here the list of stats i got my from query..

A
1
3
4
6
8
Now on these stats , i need to get one more column say B..which should the contain the values..like this..

i.e in B column first column must have differnce of A 2ndcolum and A 1stcolumn
similary it has get for all the values..

ie B1=(A2-A1)
B2=(A3-A2)...

so at last i need the stats like this..

A B
1 2 (A2-A1)
3 1 (A3-A2)
4 2 (A4-A3)
6 2 (A5-A4)
8 -7 (A1-A5)

Please Help ..

Tags (1)
0 Karma
1 Solution

dart
Splunk Employee
Splunk Employee

Does the delta command do what you need?

View solution in original post

dart
Splunk Employee
Splunk Employee

Does the delta command do what you need?

rakesh_498115
Motivator

A B

2 1
3 1
4 1
6 2

this is final table where set A is obtained from my search query

0 Karma

dart
Splunk Employee
Splunk Employee

Can you draw the final product for that example data, I'm afraid I still can't see what you're trying to do.

0 Karma

rakesh_498115
Motivator

yeah..

Consider this the column.

A B

2 1

3 1
4 1
6 2

here in B column first value is the avg of all the three values .. ie (1+1+2)/4=1

i have got the these three values using delta command ..

|delta A as B p=1

but i need to replace the first value with the avg of remaing values..??
please help

0 Karma

dart
Splunk Employee
Splunk Employee

I'm not sure I understand your desired final product. Can you draw a table illustrating this?

0 Karma

rakesh_498115
Motivator

Yeah exactly thanx..now can i get the avg of all the values in the list and update this value in the first column of the same list...??

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...