I have the following table:
Month Value
September 12
October 78
November 88
December 132
I want to display the value of October in September, November in October and so on. The final output should look like this:
Month Value
September 78
October 88
November 132
December Value of January
How can this be achieved? Please help. Thanks in advance.
try adding this to the end (assuming Value keeps growing):
...|sort 0 Value|streamstats window=1 current=f values(Month) as prevMonth|rename prevMonth as Month|where isnotnull(Month)
if Value doesn't keep growing and it is already sorted how you need it, just remove the sort command.
Rather than values()
, I'd generally use last()
-- or even better, latest()
, if there is a _time
field --but they are functionally equivalent in this case.