https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510488#M142875 <P>So suppose that everyday Splunk takes in a report that houses 9 different fields, one of which is called 'status'. Status has the option of being 'New', 'Closed', or 'Open'. I'm trying to show a time-chart that shows the count per day of reports that have 'Closed' and 'New' status , along with the difference of the two (everyday). So a file with report_date '2020-07-23' is ingested in Splunk and shows we had 5 'New' reports, 7 'Closed' Reports, so the difference should be 2 for that day. How do I go about doing this in my search query?</P><P>&nbsp;</P><LI-CODE lang="markup">index=blah... | timechart count(report_date) by status| fields - OPEN</LI-CODE><P>&nbsp;</P><P>This is where I'm stuck, how do I get the difference of only NEW and CLOSED included into my graph. Thanks in advance</P> Wed, 22 Jul 2020 16:11:28 GMT Username1 2020-07-22T16:11:28Z https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510488#M142875 <P>So suppose that everyday Splunk takes in a report that houses 9 different fields, one of which is called 'status'. Status has the option of being 'New', 'Closed', or 'Open'. I'm trying to show a time-chart that shows the count per day of reports that have 'Closed' and 'New' status , along with the difference of the two (everyday). So a file with report_date '2020-07-23' is ingested in Splunk and shows we had 5 'New' reports, 7 'Closed' Reports, so the difference should be 2 for that day. How do I go about doing this in my search query?</P><P>&nbsp;</P><LI-CODE lang="markup">index=blah... | timechart count(report_date) by status| fields - OPEN</LI-CODE><P>&nbsp;</P><P>This is where I'm stuck, how do I get the difference of only NEW and CLOSED included into my graph. Thanks in advance</P> Wed, 22 Jul 2020 16:11:28 GMT https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510488#M142875 Username1 2020-07-22T16:11:28Z https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510501#M142877 <P>This should do it.</P><LI-CODE lang="markup">index=blah... | timechart count(report_date) by status | fields - OPEN | eval diff=abs(New - Closed)</LI-CODE> Wed, 22 Jul 2020 17:35:54 GMT https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510501#M142877 richgalloway 2020-07-22T17:35:54Z https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510502#M142878 <P>That worked perfectly. Thank you!</P> Wed, 22 Jul 2020 17:40:02 GMT https://community.splunk.com/t5/Splunk-Search/Add-a-column-that-is-the-difference-of-the-first-two-columns/m-p/510502#M142878 Username1 2020-07-22T17:40:02Z