https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580556#M202260 <LI-CODE lang="markup">| eval "Successful Plays%" = 'Successful Plays%' - ('EBVS%' + 'PFAVS%')</LI-CODE> Tue, 11 Jan 2022 07:52:41 GMT ITWhisperer 2022-01-11T07:52:41Z https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580501#M202239 <P>Can anyone assist me with the SPL to subtract EBVS% and PFAVS% fields to allow the successful plays field to improve?&nbsp;<BR />I've attached a screenshot below.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="EvansB_0-1641837879833.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17499iCADC8118A2F4DFD0/image-size/medium?v=v2&amp;px=400" role="button" title="EvansB_0-1641837879833.png" alt="EvansB_0-1641837879833.png" /></span></P><P>&nbsp;</P> Mon, 10 Jan 2022 18:06:39 GMT https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580501#M202239 EvansB 2022-01-10T18:06:39Z https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580505#M202241 <P>Hi</P><P>as&nbsp;<A href="https://docs.splunk.com/Documentation/SCS/current/Search/Quotations" target="_blank">https://docs.splunk.com/Documentation/SCS/current/Search/Quotations</A>&nbsp;told you should surround field name with ‘ -character when field name contains special characters.</P><P>r. Ismo&nbsp;</P> Mon, 10 Jan 2022 18:28:43 GMT https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580505#M202241 isoutamo 2022-01-10T18:28:43Z https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580508#M202243 <P>Thanks, but how can I subtract '<SPAN>EBVS%' and 'PFAVS%' fields from the 'successful plays%' field to increase the&nbsp;successful plays KPI?</SPAN></P> Mon, 10 Jan 2022 18:49:45 GMT https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580508#M202243 EvansB 2022-01-10T18:49:45Z https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580556#M202260 <LI-CODE lang="markup">| eval "Successful Plays%" = 'Successful Plays%' - ('EBVS%' + 'PFAVS%')</LI-CODE> Tue, 11 Jan 2022 07:52:41 GMT https://community.splunk.com/t5/Splunk-Search/Field-subtraction/m-p/580556#M202260 ITWhisperer 2022-01-11T07:52:41Z