https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184183#M53065 <P>Getting closer, I fixed your statement to:<BR /> sourcetype="tracker logs" join=<EM>join</EM> OR join=<EM>leave</EM> | eval users=if(join=="<EM>join</EM>",1,-1) | accum users| timechart max(users)</P> <P>but looks like it doesn't match the join field to the value <EM>join</EM><BR /> the values that the join field gets are either "join":true or "leave":true</P> Wed, 29 Oct 2014 15:08:15 GMT shacharz 2014-10-29T15:08:15Z https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184181#M53063 <P>I have an event for a user that joins the system and an even for a user that leaves that system.<BR /> I want to create a timechart that will show how many users I had in my system along a time window.<BR /> This is for example how I timechart the join events:<BR /> sourcetype="tracker logs" join = <EM>join</EM> | timechart dc(peerId)<BR /> and similiarly for leave: sourcetype="tracker logs" join = <EM>leave</EM> | timechart dc(peerId)<BR /> But how do I substract those who leave from those who joined?</P> Wed, 29 Oct 2014 10:43:38 GMT https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184181#M53063 shacharz 2014-10-29T10:43:38Z https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184182#M53064 <P>Try something like this</P> <PRE><CODE>sourcetype="tracker logs" join="join" OR join="leave" | eval users=if(join="join",1,-1) | accum users| timechart max(users) </CODE></PRE> Wed, 29 Oct 2014 14:49:20 GMT https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184182#M53064 somesoni2 2014-10-29T14:49:20Z https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184183#M53065 <P>Getting closer, I fixed your statement to:<BR /> sourcetype="tracker logs" join=<EM>join</EM> OR join=<EM>leave</EM> | eval users=if(join=="<EM>join</EM>",1,-1) | accum users| timechart max(users)</P> <P>but looks like it doesn't match the join field to the value <EM>join</EM><BR /> the values that the join field gets are either "join":true or "leave":true</P> Wed, 29 Oct 2014 15:08:15 GMT https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184183#M53065 shacharz 2014-10-29T15:08:15Z https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184184#M53066 <P>Looks like this works:<BR /> sourcetype="tracker logs" join=<EM>join</EM> OR join=<EM>leave</EM> | eval users=if(match(join,"join"),1,-1) | accum users| timechart max(users)</P> Wed, 29 Oct 2014 15:20:03 GMT https://community.splunk.com/t5/Splunk-Search/Getting-the-number-of-parallel-intervals-in-timechart-from-start/m-p/184184#M53066 shacharz 2014-10-29T15:20:03Z