https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469416#M192048 <P>the problem is that after stats command you have only the fields the are in the stats, in your example you have only Field1Total, probably you have to use evenstats command or the values option of stats.</P> <PRE><CODE> index=index_name | eventstats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference </CODE></PRE> <P>or</P> <PRE><CODE> index=index_name | stats count(Field2) as Field2Total values(Field1) as Field1Total | eval Difference=Field2Total - Field1Total | table Difference </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Sun, 09 Feb 2020 16:10:31 GMT gcusello 2020-02-09T16:10:31Z https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469415#M192047 <P>Hi guys,</P> <P>I'm having trouble making a simple subtraction (well, I thought it would be simple!). Field1 is a number in string format, Field2 is a count of events. What am I doing wrong?</P> <PRE><CODE>index=index_name | convert num(Field1) as Field1Total | stats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference </CODE></PRE> <P>Thanks for your help! </P> Sun, 09 Feb 2020 14:47:20 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469415#M192047 driva 2020-02-09T14:47:20Z https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469416#M192048 <P>the problem is that after stats command you have only the fields the are in the stats, in your example you have only Field1Total, probably you have to use evenstats command or the values option of stats.</P> <PRE><CODE> index=index_name | eventstats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference </CODE></PRE> <P>or</P> <PRE><CODE> index=index_name | stats count(Field2) as Field2Total values(Field1) as Field1Total | eval Difference=Field2Total - Field1Total | table Difference </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Sun, 09 Feb 2020 16:10:31 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469416#M192048 gcusello 2020-02-09T16:10:31Z https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469417#M192049 <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Convert">Convert</A></P> <P>Automatically convert the fields to a number using the best conversion.<BR /> <CODE>convert</CODE> use <EM>conversion</EM> .</P> <P>If you want to modify to number, simply <CODE>tonumber()</CODE></P> Sun, 09 Feb 2020 20:38:34 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-One-Field-from-Another/m-p/469417#M192049 to4kawa 2020-02-09T20:38:34Z