https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575093#M200392 <LI-CODE lang="markup">| sort 0 PROJECT_NUMBER _time | streamstats values(TotalHours) as previousTotalHours current=f window=1 by PROJECT_NUMBER | eval diff=previousTotalHours-TotalHours</LI-CODE> Tue, 16 Nov 2021 16:56:58 GMT ITWhisperer 2021-11-16T16:56:58Z https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575091#M200391 <P>I am trying to create a Timechart that will list out the TotalHours of that day and then subtract the previous days TotalHours to see the Hours difference in each day. This needs to span 14 days&nbsp;&nbsp;</P><P>Basically I just need the Total Hours difference from One day to the next spanned across a timechart&nbsp;</P><P>This is the data and Query I have so far (not much)</P><P>-------Search-----<BR />| where TotalHours != "0" AND _time&gt;relative_time(now(), "-14d@d")<BR />| dedup PROJECT_NUMBER _time<BR />| table PROJECT_NUMBER TotalHours _time<BR />| sort by PROJECT_NUMBER</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="keezy713_0-1637080919559.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16875i589E40FAA5044319/image-size/medium?v=v2&amp;px=400" role="button" title="keezy713_0-1637080919559.png" alt="keezy713_0-1637080919559.png" /></span></P><P>&nbsp;</P> Tue, 16 Nov 2021 16:43:29 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575091#M200391 keezy713 2021-11-16T16:43:29Z https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575093#M200392 <LI-CODE lang="markup">| sort 0 PROJECT_NUMBER _time | streamstats values(TotalHours) as previousTotalHours current=f window=1 by PROJECT_NUMBER | eval diff=previousTotalHours-TotalHours</LI-CODE> Tue, 16 Nov 2021 16:56:58 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575093#M200392 ITWhisperer 2021-11-16T16:56:58Z https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575105#M200398 <P>Below is the query that I have now&nbsp;<BR /><BR />Search<BR />|table PROJECT_NUMBER _time TotalHours<BR />| sort 0 PROJECT_NUMBER _time<BR />| streamstats values(TotalHours) as previousTotalHours current=f window=1 by PROJECT_NUMBER<BR />| eval diff=previousTotalHours-TotalHours<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="keezy713_0-1637084938230.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16876i3405612EEFACC81E/image-size/medium?v=v2&amp;px=400" role="button" title="keezy713_0-1637084938230.png" alt="keezy713_0-1637084938230.png" /></span></P><P>Im trying to see if I can get just the diff streamed out over a time period</P> Tue, 16 Nov 2021 18:11:03 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575105#M200398 keezy713 2021-11-16T18:11:03Z https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575106#M200399 <LI-CODE lang="markup">| xyseries _time PROJECT_NUMBER diff</LI-CODE> Tue, 16 Nov 2021 18:13:41 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575106#M200399 ITWhisperer 2021-11-16T18:13:41Z https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575110#M200401 <P>This is what I'm getting now.</P><P>I think its just populating from all the Projects.</P><P>Is there a way to get all the project (sum) TotalHours and then subtract that from the previous days total of TotalHours and then set x axis as _time and Y&nbsp; axis as diff streamed across 2 weeks?</P><P>Again thanks for your help&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="keezy713_0-1637086654484.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/16877iE705A7885613EC02/image-size/medium?v=v2&amp;px=400" role="button" title="keezy713_0-1637086654484.png" alt="keezy713_0-1637086654484.png" /></span></P><P>&nbsp;</P> Tue, 16 Nov 2021 18:22:17 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575110#M200401 keezy713 2021-11-16T18:22:17Z https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575113#M200402 <LI-CODE lang="markup">| timechart sum(diff) as Total</LI-CODE> Tue, 16 Nov 2021 18:31:24 GMT https://community.splunk.com/t5/Splunk-Search/Unable-to-subtract-one-days-hours-from-previous-days-to-create/m-p/575113#M200402 ITWhisperer 2021-11-16T18:31:24Z