Splunk Search

How can I reorder this table so the column B data represents the month prior?

ASISH_9
Engager

I have the following table:

Month                 Value
September             12
October               78
November              88
December              132

I want to display the value of October in September, November in October and so on. The final output should look like this:

Month                 Value
September             78
October               88
November              132
December              Value of January

How can this be achieved? Please help. Thanks in advance.

0 Karma

cmerriman
Super Champion

try adding this to the end (assuming Value keeps growing):

...|sort 0 Value|streamstats window=1 current=f values(Month) as prevMonth|rename prevMonth as Month|where isnotnull(Month)

if Value doesn't keep growing and it is already sorted how you need it, just remove the sort command.

DalJeanis
Legend

Rather than values(), I'd generally use last() -- or even better, latest(), if there is a _time field --but they are functionally equivalent in this case.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...