topic Re: How do i subtract values from the same field and table results by another field in this case Field B in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338100#M100284 <P>i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB</P> <P>Thanks elliotproebstel, i got a clue when you mentioned Max and Min</P> Fri, 09 Mar 2018 21:07:00 GMT Bentash 2018-03-09T21:07:00Z How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338095#M100279 <P>How do i subtract values from the same field and table results by another field in this case Field B</P> <P>subtract 400 - 200 for value 1<BR /> and 300 - 200 for value 2</P> <P>FieldA FieldB FieldC<BR /> 200 value1 may-2-2018<BR /> 300 value2 June-2-2018<BR /> 400 value1 may-2-2018<BR /> 200 value2 Jun2-2-2018</P> Fri, 09 Mar 2018 18:50:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338095#M100279 Bentash 2018-03-09T18:50:48Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338096#M100280 <P>How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.</P> Fri, 09 Mar 2018 20:04:51 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338096#M100280 elliotproebstel 2018-03-09T20:04:51Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338097#M100281 <P>i correct 300-300 its a type.. and i am determining the results for Value1 and 2 because i want to get the difference between those two result sets since that are coming from different dates </P> Fri, 09 Mar 2018 20:39:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338097#M100281 Bentash 2018-03-09T20:39:15Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338098#M100282 <P>Great, then I think this should do it for you:</P> <PRE><CODE>base search that gets you the table above | stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC | eval FieldA=max_FieldA-min_FieldA | fields FieldA FieldB FieldC </CODE></PRE> Fri, 09 Mar 2018 20:43:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338098#M100282 elliotproebstel 2018-03-09T20:43:18Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338099#M100283 <P>i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB</P> <P>Thanks elliotproebstel, i got a clue when you mentioned Max and Min</P> Fri, 09 Mar 2018 21:06:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338099#M100283 Bentash 2018-03-09T21:06:46Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338100#M100284 <P>i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB</P> <P>Thanks elliotproebstel, i got a clue when you mentioned Max and Min</P> Fri, 09 Mar 2018 21:07:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338100#M100284 Bentash 2018-03-09T21:07:00Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338101#M100285 <P>Glad to help!</P> Fri, 09 Mar 2018 21:09:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338101#M100285 elliotproebstel 2018-03-09T21:09:13Z Re: How do i subtract values from the same field and table results by another field in this case Field B https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338102#M100286 <P>hey Bentash,</P> <P>Please accept the answer by elliotproebstel to close the question.</P> Sat, 10 Mar 2018 02:21:34 GMT https://community.splunk.com/t5/Splunk-Search/How-do-i-subtract-values-from-the-same-field-and-table-results/m-p/338102#M100286 deepashri_123 2018-03-10T02:21:34Z