https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262000#M78659 <P>Try this</P> <PRE><CODE>"Sending" OR "Receiving" earliest=-7days | rex "(?&lt;action&gt;Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving </CODE></PRE> Mon, 23 May 2016 23:27:09 GMT sundareshr 2016-05-23T23:27:09Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/261999#M78658 <P>I display two different graphs by using the following strings.</P> <PRE><CODE>"Sending" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes sent" "Receiving" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes received" </CODE></PRE> <P>I can display both in the same graph by:</P> <PRE><CODE>"Sending" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes sent" | appendcols [search "Receiving" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes received"] </CODE></PRE> <P>This gives me two lines (each has a value for one day for the past 7 days).</P> <P>How do I display the difference between gigabytes sent and received? I want to display Gigabytes sent - gigabytes received for each day for the past 7 days.</P> Mon, 23 May 2016 23:16:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/261999#M78658 thewho123 2016-05-23T23:16:04Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262000#M78659 <P>Try this</P> <PRE><CODE>"Sending" OR "Receiving" earliest=-7days | rex "(?&lt;action&gt;Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving </CODE></PRE> Mon, 23 May 2016 23:27:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262000#M78659 sundareshr 2016-05-23T23:27:09Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262001#M78660 <P>Is the syntax correct? I get null for y-axis description.</P> <P>Also avg bytes from sending and receiving should be separate. Wouldn't this combine all of them together ?</P> Mon, 23 May 2016 23:34:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262001#M78660 thewho123 2016-05-23T23:34:06Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262002#M78661 <P>Do you not see columns for Sending and Receiving? The avg(gb) will be calculated separately for each action. If NULL is the third column, you could add <CODE>usenull=f</CODE> to the timechart command. You search would look like this</P> <PRE><CODE>index=myIndex sourcetype=mySourcetype "Sending" OR "Receiving" earliest=-7d@d | rex "(?&lt;action&gt;Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart usenull=f span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving </CODE></PRE> Tue, 24 May 2016 00:46:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-difference-between-the-results-from-two/m-p/262002#M78661 sundareshr 2016-05-24T00:46:33Z