https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353579#M104658 <P>Thank you for your explanation. @ssadanala1<BR /> When I converted that field in a number those commas [,] has been removed and then my query is working fine and returning expected result.</P> Wed, 02 May 2018 14:46:44 GMT rashidjorvee 2018-05-02T14:46:44Z https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353574#M104653 <P>I have a table which have fields Rank, City, Population _2001, Population _2011. Now I want to find the growth in population for respective cities. I try fetching the growth with "eval growth=P2011-P2001", but it didn't work. Please suggest some way to achieve this.</P> <P>Search Query: index="rashid" City=A* AND "Population _2001"&gt;="100000" | table Rank, City, "Population _2001", "Population _2011" |rename "Population _2001" as P2001|rename "Population _2011" as P2011| eval growth=P2011-P2001</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4806iF8AA077637FB62D1/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 24 Apr 2018 04:35:28 GMT https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353574#M104653 rashidjorvee 2018-04-24T04:35:28Z https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353575#M104654 <P>I think the problem is the values are seen as strings because of commas,<BR /> add the following before your eval to convert strings to numbers:</P> <PRE><CODE>| convert num(P2001) num(P2011) </CODE></PRE> Tue, 24 Apr 2018 13:58:57 GMT https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353575#M104654 damien_chillet 2018-04-24T13:58:57Z https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353576#M104655 <P>Also, worth saying that your filter &gt;= 100000 does not seem to work because Aurangabad is in the results and has 79,393 inhabitants.<BR /> You will have to create a calculated field to remediate that.</P> Tue, 24 Apr 2018 14:00:48 GMT https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353576#M104655 damien_chillet 2018-04-24T14:00:48Z https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353577#M104656 <P>The reason why the values are not subtracted because of "," in the number make splunk to consider them as string and unable to do the caluclation .</P> <P>For this we need to convert the fields to number so that "," will be removed and then eval diff = p1 - p2 </P> <P>For example </P> <P>|makeresults |eval p1 = "2,000;1,000" |eval p2= "10,00;2,000" | eval p1 = split(p1,";") |eval p2 = split(p2, ";") |mvexpand p1 |mvexpand p2 |convert num(p*) |eval diff = p1-p2</P> Tue, 24 Apr 2018 14:04:20 GMT https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353577#M104656 ssadanala1 2018-04-24T14:04:20Z https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353578#M104657 <P>Yes, this filter is not working as well.</P> Wed, 02 May 2018 14:44:25 GMT https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353578#M104657 rashidjorvee 2018-05-02T14:44:25Z https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353579#M104658 <P>Thank you for your explanation. @ssadanala1<BR /> When I converted that field in a number those commas [,] has been removed and then my query is working fine and returning expected result.</P> Wed, 02 May 2018 14:46:44 GMT https://community.splunk.com/t5/Splunk-Search/Substract-values-of-two-columns-and-display-the-difference-in/m-p/353579#M104658 rashidjorvee 2018-05-02T14:46:44Z