https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497736#M138619 <P>Hello Splunkers,</P> <P>I have a trouble with the result, example i have some data log</P> <P>Goat | alive<BR /> Goat | dead<BR /> Goat | alive</P> <P>Rabit | alive<BR /> Rabit | dead</P> <P>my trouble is , how to get data count alive or dead , example a Goat (alive =2 , dead = 1) diff = alive - dead (1) , and Rabit(alive=1 , dead=1) diff = alive - dead (0), i want to create table of result <BR /> Animal | alive | dead | diff<BR /> Goat | 2 | 1 | 1<BR /> Rabit | 1 | 1 | 0</P> <P>please help me for the query, thank you splunkers</P> Thu, 19 Mar 2020 11:12:03 GMT mockingj 2020-03-19T11:12:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497736#M138619 <P>Hello Splunkers,</P> <P>I have a trouble with the result, example i have some data log</P> <P>Goat | alive<BR /> Goat | dead<BR /> Goat | alive</P> <P>Rabit | alive<BR /> Rabit | dead</P> <P>my trouble is , how to get data count alive or dead , example a Goat (alive =2 , dead = 1) diff = alive - dead (1) , and Rabit(alive=1 , dead=1) diff = alive - dead (0), i want to create table of result <BR /> Animal | alive | dead | diff<BR /> Goat | 2 | 1 | 1<BR /> Rabit | 1 | 1 | 0</P> <P>please help me for the query, thank you splunkers</P> Thu, 19 Mar 2020 11:12:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497736#M138619 mockingj 2020-03-19T11:12:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497737#M138620 <P>hi @mockingj,</P> <P>Try this:</P> <PRE><CODE>| makeresults | eval _raw="_raw Goat | alive Goat | dead Goat | alive Rabit | alive Rabit | dead" | multikv forceheader=1 | rex "(?&lt;Animal&gt;\w+)\s\|\s(?&lt;status&gt;\w+)" | stats count(eval(status="alive")) as alive, count(eval(status="dead")) as dead by Animal | eval diff=alive-dead </CODE></PRE> Thu, 19 Mar 2020 12:50:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497737#M138620 manjunathmeti 2020-03-19T12:50:14Z https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497738#M138621 <P>See if this helps.</P> <PRE><CODE>... | stats count(eval(state="alive")) as AliveCount, count(eval(state="dead")) as DeadCount by Animal | eval diff = AliveCount - DeadCount | table Animal, AliveCount, DeadCount, diff </CODE></PRE> Thu, 19 Mar 2020 12:50:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497738#M138621 richgalloway 2020-03-19T12:50:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497739#M138622 <P>wonderful answer :)) , the best word <STRONG>by Animal</STRONG> , thank you very much</P> Thu, 19 Mar 2020 14:08:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497739#M138622 mockingj 2020-03-19T14:08:44Z https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497740#M138623 <P>thanks you for your answer</P> Thu, 19 Mar 2020 14:10:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-diff-count-and-show-field-and-result-of-diff/m-p/497740#M138623 mockingj 2020-03-19T14:10:48Z