topic Re: How can I add a column at the end that shows the difference between the two weeks? in Splunk Search

How can I add a column at the end that shows the difference between the two weeks?

JoeHubner — Fri, 20 May 2022 19:03:35 GMT

I would like to add a column to a chart that is the difference of the two columns before it in an application where I am showing the Cost for each employee for the last 2 weeks. Using the search:

index=SampleData

| where _time>relative_time(now(),"-2w@w")

| convert timeformat="%m-%d-%Y" ctime(_time)

| chart sum(Cost) over Employee by _time

The above produces a chart that looks like the following

Employee 05-08-2022 05-15-2022

Employee1 100.00 150.00
Employee2 200.00 175.00

How can I add a column at the end that shows the difference between the two weeks?

Re: How can I add a column at the end that shows the difference between the two weeks?

somesoni2 — Fri, 20 May 2022 19:10:26 GMT

Give this a try

Re: How can I add a column at the end that shows the difference between the two weeks?

JoeHubner — Fri, 20 May 2022 19:14:52 GMT

Worked perfect, thanks.