<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Subtraction in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Subtraction/m-p/70382#M180697</link>
    <description>&lt;P&gt;Greetings,&lt;/P&gt;

&lt;P&gt;I am looking to perform subtraction.  I have formatted my search to get me down to specific values and lastly I am looking to perform subtraction.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    Stage           analyst Count
1   5. Completed    Marta   114
2   4. Selection    Marta   44
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So what I would like is to return a single value of 70.  Feels like I have done the heavy lifting already but am stuck on the final bit.  Help?&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;

&lt;P&gt;Dave&lt;/P&gt;</description>
    <pubDate>Thu, 20 Jun 2013 16:21:12 GMT</pubDate>
    <dc:creator>ccsfdave</dc:creator>
    <dc:date>2013-06-20T16:21:12Z</dc:date>
    <item>
      <title>Subtraction</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Subtraction/m-p/70382#M180697</link>
      <description>&lt;P&gt;Greetings,&lt;/P&gt;

&lt;P&gt;I am looking to perform subtraction.  I have formatted my search to get me down to specific values and lastly I am looking to perform subtraction.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;    Stage           analyst Count
1   5. Completed    Marta   114
2   4. Selection    Marta   44
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;So what I would like is to return a single value of 70.  Feels like I have done the heavy lifting already but am stuck on the final bit.  Help?&lt;/P&gt;

&lt;P&gt;Thanks,&lt;/P&gt;

&lt;P&gt;Dave&lt;/P&gt;</description>
      <pubDate>Thu, 20 Jun 2013 16:21:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Subtraction/m-p/70382#M180697</guid>
      <dc:creator>ccsfdave</dc:creator>
      <dc:date>2013-06-20T16:21:12Z</dc:date>
    </item>
    <item>
      <title>Re: Subtraction</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Subtraction/m-p/70383#M180698</link>
      <description>&lt;P&gt;|stats range(Count)&lt;/P&gt;

&lt;P&gt;That did it for me.  Thanks for looking!&lt;/P&gt;</description>
      <pubDate>Thu, 20 Jun 2013 16:59:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Subtraction/m-p/70383#M180698</guid>
      <dc:creator>ccsfdave</dc:creator>
      <dc:date>2013-06-20T16:59:09Z</dc:date>
    </item>
  </channel>
</rss>

