Subtracting time charts

[priyangshupal]

I have a timechart from the command timechart span=1d count by skill1 which looks like this:

_time	VALUE1	VALUE2	VALUE3	VALUE4
2021-09-15	77	243	17	28
2021-09-16	80	104	65	22

And another timechart from the command timechart span=1d count by skill2 which looks like this:

_time	VALUE1	VALUE2	VALUE3	VALUE4
2021-09-15	70	200	10	12
2021-09-16	56	87	54	11

I want to create a new timechart which should have skill1's values - skill2's values. As follows:

_time	VALUE1	VALUE2	VALUE3	VALUE4
2021-09-15	7	43	7	16
2021-09-16	14	17	11	11

I tried using the command:

timechart span=1d count by skill1-skill2

But it won't work.

Any suggestions on how to create the new timechart?

[bowesmana]

Alternatively if you can share your data selection part of the search, it can probably be done using subsearches to join the two data sets together.

[bowesmana]

You can do this type of timechart with eval and then calc the differences afterwards, but that my not work unless you know and can code in all the values of skill

| makeresults count=1000
| eval _time=_time-(random() % 7)*86400
| eval skill1=mvindex(split("Value1,Value2,Value3,Value4",","), random() % 4)
| eval skill2=mvindex(split("Value1,Value2,Value3,Value4",","), random() % 4)
| timechart span=1d sum(eval(if(skill1="Value1", 1, 0))) as s1v1 sum(eval(if(skill1="Value2", 1, 0))) as s1v2 sum(eval(if(skill1="Value3", 1, 0))) as s1v3 sum(eval(if(skill1="Value4", 1, 0))) as s1v4 sum(eval(if(skill2="Value1", 1, 0))) as s2v1 sum(eval(if(skill2="Value2", 1, 0))) as s2v2 sum(eval(if(skill2="Value3", 1, 0))) as s2v3 sum(eval(if(skill2="Value4", 1, 0))) as s2v4
| eval v1=s1v1-s2v1, v2=s1v2-s2v2, v3=s1v3-s2v3, v4=s1v4-s2v4
| table _time v*

Just paste in this to the search window

[priyangshupal]

Hi @bowesmana 

This is producing results, but the difference is wrong