I'm attempting to calculate the deltas between a field and it's historical value. I use a subquery w/ appendcols to return the historical data and it is nicely in the form:
Group, field1, field2, field1_historical, field2_historical
I can create the deltas with:
| eval field1_delta = field1 - field1_historical
| eval field2_delta = field2 - field2_historical
This works but I'd like to generalize it:
| eval *_delta = * - *_historical
but I get the error:
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '* - *_historical'.
Any tips?
Sorry, no. You'll just have to type it out. You can try using a macro to shorten your typing, but you're still going to have to specify the field base names.
sbsbb, if this is something you need make sure your file an enhancement request about it.
I need this function too, hopefully it will come with next release of splunk
An alternative to typing them out, especially if the field names are dynamic, would be to write your own search command to do this task.