Same Column Value Difference

[reverse]

C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86

how to find difference in values of C2 for every same C1 value

[vnravikumar · Accepted solution]

Hi

Try this

source="diff.csv" host="ind1" sourcetype="csv" 
| table C1 C2 
| sort C1 
| stats values(C2) as C2 by C1 
| eval num1 = mvindex(C2,0) 
| eval num2 = mvindex(C2,1) 
| eval diff = num2-num1 
| table C1,C2,diff

[reverse]

It worked!!!

Thank you !!!.. but what if there are multiple As Bs Cs and Ds
As of now this solution is perfect for 2 same values.

[reverse]

@vnravikumar can we make a generic solution ?

[reverse]

@Vijeta @jnudell_2 You around folks ?

[reverse]

https://answers.splunk.com/answers/760695/generic-solution-to-same-column-value-difference.html?minQ...

[reverse]

@Vijeta Please guide.

[vnravikumar]

Example, please

[reverse]

It is there ..

C1 C2
A 12
A 120
B 45
B 78
C 98
C 90
D 0
D 86