topic Re: How do you subtract values from an appended search? in Splunk Search

How do you subtract values from an appended search?

jephillips — Wed, 06 Feb 2019 14:13:39 GMT

I'm trying to run the below searches and get the subtracted value from them. However, the eval command is not giving me a new Difference field. I just get the results of the separate searches.

index=a sourcetype=test start=* end=* | eventstats count as Total1
| append [search index=a sourcetype=test start=* end=* xfer=* | eventstats count as Total2]
| eval Difference=Total1 - Total2

I'd like a chart that with a row for all three values.

Total1        Total2          Difference
10               8                   2

Re: How do you subtract values from an appended search?

vishaltaneja070 — Wed, 06 Feb 2019 14:46:34 GMT

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

Re: How do you subtract values from an appended search?

jephillips — Wed, 06 Feb 2019 14:49:48 GMT

That did it! Thanks for the help.

Re: How do you subtract values from an appended search?

Vijeta — Wed, 06 Feb 2019 14:51:31 GMT

You can try the below search-

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

Re: How do you subtract values from an appended search?

vishaltaneja070 — Thu, 07 Feb 2019 06:15:40 GMT

@jephillips
Great 🙂

Please accept the answer to close the thread.

Re: How do you subtract values from an appended search?

woodcock — Fri, 08 Feb 2019 16:42:28 GMT

Be sure to click Accept to close the question and help others find working answers.