https://community.splunk.com/t5/Getting-Data-In/subtract-value-on-Subquery/m-p/236980#M46039 <P>The following search may be closer to what you want. However, you can't have a timechart at the end of this pipeline, because you have factored out <CODE>_time</CODE> in the stats commands. And you don't need a subsearch.</P> <PRE><CODE>sourcetype="service_ppe" source="/var/log/httpClient*.log" OR source="/var/log/request*.log" | eval type=if(match(source,"/var/log/request.*.log"),"response","external_response") | chart sum(time_ms) by trace_id type | eval price_response=response - external_response </CODE></PRE> <P>For each trace_id, this calculates the sum of the time_ms. If the time_ms comes from the httpClient log, it is added to the external_response. If the time_ms comes from the request log, it is added to the response. Finally, the difference between the two is calculated for each trace_id. The resulting table will show the trace_id, external_response, response, and price_response.</P> <P>If you want a timechart, exactly what do you want to see on the chart?</P> Tue, 29 Sep 2020 12:26:27 GMT lguinn2 2020-09-29T12:26:27Z https://community.splunk.com/t5/Getting-Data-In/subtract-value-on-Subquery/m-p/236979#M46038 <P>So basically I want to make a subquery where I can use the values founded in the first query to make a subtract from the second subquery</P> <P>external_response=Time </P> <P>so the idea is get the subquery sum all times for traceId and then subtract the external_time</P> <P>Any idea how to accomplish this?</P> <P>sourcetype="service_ppe" source="/var/log/httpClient*.log" | stats sum(time_ms) as external_response by trace_id | join external_response [search sourcetype="service_ppe" source="/var/log/request*.log" | stats sum(time_ms) as response by trace_id | eval price_response=(response - external_response) | timechart count(price_response) ]</P> <P>Regards.</P> Tue, 29 Sep 2020 12:26:24 GMT https://community.splunk.com/t5/Getting-Data-In/subtract-value-on-Subquery/m-p/236979#M46038 politrons 2020-09-29T12:26:24Z https://community.splunk.com/t5/Getting-Data-In/subtract-value-on-Subquery/m-p/236980#M46039 <P>The following search may be closer to what you want. However, you can't have a timechart at the end of this pipeline, because you have factored out <CODE>_time</CODE> in the stats commands. And you don't need a subsearch.</P> <PRE><CODE>sourcetype="service_ppe" source="/var/log/httpClient*.log" OR source="/var/log/request*.log" | eval type=if(match(source,"/var/log/request.*.log"),"response","external_response") | chart sum(time_ms) by trace_id type | eval price_response=response - external_response </CODE></PRE> <P>For each trace_id, this calculates the sum of the time_ms. If the time_ms comes from the httpClient log, it is added to the external_response. If the time_ms comes from the request log, it is added to the response. Finally, the difference between the two is calculated for each trace_id. The resulting table will show the trace_id, external_response, response, and price_response.</P> <P>If you want a timechart, exactly what do you want to see on the chart?</P> Tue, 29 Sep 2020 12:26:27 GMT https://community.splunk.com/t5/Getting-Data-In/subtract-value-on-Subquery/m-p/236980#M46039 lguinn2 2020-09-29T12:26:27Z