https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450558#M127577 <P>one with ! in it...in the transaction command...</P> Wed, 31 Oct 2018 11:29:20 GMT archonixm 2018-10-31T11:29:20Z https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450556#M127575 <P>index=oswindows sourcetype="winhost" host=<EM>npe</EM> OR host=<EM>npw</EM> source=service earliest="-30d@d" latest="@d DisplayName="Vontu Monitor" <BR /> | transaction DisplayName !(startswith="State=Stopped" endswith="State=Running") <BR /> | stats sum(duration) as abc1 by host,DisplayName </P> <P>index=oswindows sourcetype="winhost" host=<EM>npe</EM> OR host=<EM>npw</EM> source=service earliest="-30d@d" latest="@d" DisplayName="Vontu Monitor" <BR /> | transaction DisplayName startswith="State=Stopped" endswith="State=Running" <BR /> | stats sum(duration) as abc2 by host, DisplayName </P> <P>What I want is to substract the first sum of value by host for first search with second search. Please help me. I tried append and appendcols but it doesn't display the second search result.</P> Wed, 31 Oct 2018 11:17:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450556#M127575 archonixm 2018-10-31T11:17:42Z https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450557#M127576 <P>The two searches are identical except for the <CODE>as</CODE> clause so the result will always be zero.<BR /> Perhaps you meant to paste a different second search?</P> Wed, 31 Oct 2018 11:25:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450557#M127576 richgalloway 2018-10-31T11:25:45Z https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450558#M127577 <P>one with ! in it...in the transaction command...</P> Wed, 31 Oct 2018 11:29:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450558#M127577 archonixm 2018-10-31T11:29:20Z https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450559#M127578 <P>This is a simple example, but give something like this a try:</P> <PRE><CODE>sourcetype=access_combined action=addtocart | stats sum(bytes) as bytes_atc by clientip | appendcols [ search sourcetype=access_combined action=purchase | stats sum(bytes) as bytes_purch by clientip] | eval sum_all=bytes_atc + bytes_purch </CODE></PRE> Wed, 31 Oct 2018 13:22:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-2-spunk-search-into-one-result-and-substract-the-sum/m-p/450559#M127578 kmorris_splunk 2018-10-31T13:22:11Z