https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527734#M148986 <P>I want difference between 155 and 132, how can i do with the Spl.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20201103_194436.jpg" style="width: 4000px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11635i4B9D855222EEE522/image-size/medium?v=v2&amp;px=400" role="button" title="IMG_20201103_194436.jpg" alt="IMG_20201103_194436.jpg" /></span></P> Tue, 03 Nov 2020 14:17:11 GMT uagraw01 2020-11-03T14:17:11Z https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527734#M148986 <P>I want difference between 155 and 132, how can i do with the Spl.</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20201103_194436.jpg" style="width: 4000px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11635i4B9D855222EEE522/image-size/medium?v=v2&amp;px=400" role="button" title="IMG_20201103_194436.jpg" alt="IMG_20201103_194436.jpg" /></span></P> Tue, 03 Nov 2020 14:17:11 GMT https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527734#M148986 uagraw01 2020-11-03T14:17:11Z https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527741#M148988 <P>Try adding this to your search</P><LI-CODE lang="markup">Your search |stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that |eval diff=this-that</LI-CODE><P>Run anywhere search</P><LI-CODE lang="markup">|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status] |stats first(eval(if(Week_Status=="this_week",Total_host,null()))) as this,first(eval(if(Week_Status=="last_week",Total_host,null()))) as that |eval diff=this-that</LI-CODE><P>&nbsp;</P><P>OR</P><LI-CODE lang="markup">Your search |eval {Week_Status}=Total_host |stats values(*) as * |eval diff=last_week-this_week</LI-CODE><LI-CODE lang="markup">|makeresults|eval Total_host="132 155"|makemv Total_host |mvexpand Total_host|appendcols [|makeresults|eval Week_Status="this_week last_week"|makemv Week_Status| mvexpand Week_Status] |eval {Week_Status}=Total_host |stats values(*) as * |eval diff=last_week-this_week</LI-CODE><P>&nbsp;</P> Tue, 03 Nov 2020 14:41:51 GMT https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527741#M148988 renjith_nair 2020-11-03T14:41:51Z https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527761#M148994 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/136781">@renjith_nair</a>&nbsp; Thanks for your response. I need to add list of difference server also in my search how can i add ? Please help</P> Tue, 03 Nov 2020 15:24:10 GMT https://community.splunk.com/t5/Splunk-Search/Dashboard/m-p/527761#M148994 uagraw01 2020-11-03T15:24:10Z