https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590220#M205478 <P>That works, is it possible to add + and - in difference?</P> Tue, 22 Mar 2022 14:10:16 GMT vikas_sood 2022-03-22T14:10:16Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590211#M205473 <P>Hi,</P> <P>i have 2 events with 3 fields: timestamp , servername, cpu_usage:</P> <P>22-Mar-2022 00:00:00, server1 ,18</P> <P>23-Mar-2022, 00:01:00 server1 , 82</P> <P>22-Mar-2022 00:00:00, server2 ,78</P> <P>23-Mar-2022, 00:01:00 server2 , 14</P> <P>I want to calculate difference between 2nd and 1st event for each server. Can you please suggest, how this can be done?</P> Wed, 23 Mar 2022 05:04:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590211#M205473 vikas_sood 2022-03-23T05:04:15Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590217#M205475 <LI-CODE lang="markup">| stats range(cpu_usage) as difference by servername</LI-CODE> Tue, 22 Mar 2022 14:02:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590217#M205475 ITWhisperer 2022-03-22T14:02:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590220#M205478 <P>That works, is it possible to add + and - in difference?</P> Tue, 22 Mar 2022 14:10:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590220#M205478 vikas_sood 2022-03-22T14:10:16Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590223#M205480 <LI-CODE lang="markup">| stats first(cpu_usage) as first_value last(cpu_usage) as last_value by servername | eval difference=last_value-first_value | eval difference=if(difference&gt;0,"+".difference,difference)</LI-CODE> Tue, 22 Mar 2022 14:27:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-difference-between-field-values-in-two-events/m-p/590223#M205480 ITWhisperer 2022-03-22T14:27:34Z