Hi.
How to use Splunk query to compare to the "count" field from previous day from a lookup table? For instance, the lookup table has fields:
date item count
------- ------- ---------
04/20/2018 box 12
04/19/2018 box 20
The end result looks like:
date item count diff
------- ------- --------- ------
04/20/2018 box 12 -8
Thanks.
The delta
command is what you'll be using, but with your source events sorted in reverse-chronological order (as they are above), it will put your diff
value on the wrong line. So try this:
your current search that gives you the first table
| reverse
| delta count AS diff
Here are the docs on delta
:
http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Delta
Thanks elliotproebstel. This is what I am looking for. I have another question: between "reverse" and "delta" subsearch, how can I loop through a lookup table and calculate the diff only matched to the lookup? Thanks.
That will be pretty easy, but to help you structure the query, can you tell me what field in your current search you'll be looking to match and the name of the column/field in the lookup table that you're matching to?