How to subtract Total Amount to WithdrawRequest to total Amount of DepositRequest?

[Kisame27]

How to subtract Total Amount to  WithdrawRequest to total Amount of  DepositRequest 

Result=WithdrawRequest-DepositRequest 

[gcusello]

Hi @Kisame27,

sorry but I don't understand, could you share your result and indicate which field you want to add to which other field?

Ciao.

Giuseppe

[Kisame27]

For Example : i have  three Column 

transactiontype      Amount       CostumerName

DP                                        20               Tom

WD                                      30               Tom

DP                                       10                Elen

WD                                      15               Elen

DP                                        50              Tom

....                                           ...                 ....

....                                           ....                ....

i want to get:    Result  as Table For Tom= Sum(Dep) -Sum(WD)   Tom= 70-30=40

                                                     Elen=  Sum(Dep) -Sum(WD)   Elen= 10-15=-5

Result as Table  With 4 columns

    DP    WD         CostumerName  Result

   70         30           Tom                        40

   10          15          Elen                        -5

   ...                          ....                             .....

    ....                         ....                            .....

thanks for Helping 

[gcusello]

Hi @Kisame27,

if the transactiontype are always the same (DP or WD), you could run something like this:

| your_search
| stats sum(eval(if(transactiontype="WD",Amount,0))) AS WD sum(eval(if(transactiontype="DP",Amount,0))) AS DP BY CostumerName
| eval Result=DP-WD

Ciao.

Giuseppe

[Kisame27]

You are Very Good Person, Thanks For Helping  😍

[gcusello]

Hi @Kisame27,

you're welcome, it's a pleasure.

Please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

[Kisame27]

cs_uri_query="*DepositRequest*" OR cs_uri_query="*WithdrawRequest*"

| rex "Amount\':(?<amount>[^+]+)"
| rex "CustomerId\':(?<GUID>[^+]+)"
|rex "ProviderName\':(?<provider>[^+]+)"
| search GUID = '3f55310a-2f17-476c-a28b-0d50c444b03f'

================================================================

DepositRequest="{'ProviderName':'Vazisubani'+'BrandName':'Betsmarket'+'CustomerId':'3f55310a-2f17-476c-a28b-'+'Amount':0.00+'TransactionId'

WithdrawRequest="{'ProviderName':'Vazisubani'+'BrandName':'BestMarket'+'CustomerId':'3f55310a-2f17-476c-a28b'+'Amount':175.0+'TransactionId':'625314d6a230ee62325ed373'

 i want to get  Table with new column which was created by me 

 CustomerId                                                DepositRequest    WithdrawRequest             Result

 3f55310a-2f17-476c-a28b                     0.00                             175                                   -175