Adding computed column in Chart by date

[hyp3rf0x]

Hi, I have a search below to compare previous 2 days Splunk usage, but I need additional column that computes the difference between 2 dates. How can we achieve this?

index=_internal source=*license_usage.log TERM(type=Usage) earliest=-2d@d latest=@d
| eval b=round(b/1024/1024/1024,2)

| bin span=1d _time | eval date=strftime(_time,"%d_%b")
| chart sum(b) AS GB over host by date

[hyp3rf0x]

Wow.. this really helps and achieves what I need. Thank you @richgalloway , much appreciated.

[richgalloway · Accepted solution]

Try this query.  Usually, we use a simple eval to find the difference between two fields, but we can't do that here because the field names aren't known.

index=_internal source=*license_usage.log TERM(type=Usage) earliest=-2d@d latest=@d 
| eval b=round(b/1024/1024/1024+(random()%10),2) 
| bin span=1d _time 
| eval date=strftime(_time,"%d_%b") 
| chart sum(b) AS GB over host by date
| eval diff=0
| foreach *_* [ eval diff=if(diff==0,'<<FIELD>>',diff-'<<FIELD>>')]