Arithmetic operation on fields from different events

[sstanlee]

Consider the below types of events

fields  :     OS         transaction      numbers

Events:     Win        purchased           150

                   Unix       purchased           200

                   Win        sold                         100

                   Unix       sold                         125

I want the results to be:

OS      InHand(purchased-sold)

Win      50

Unix     75

How to do this?

[thambisetty · Accepted solution]

| makeresults | eval _raw="OS,transaction,numbers
Win,purchased,150
Unix,purchased,200
Win,sold,100
Unix,sold,125"
| multikv forceheader=1
| xyseries OS transaction numbers
| eval InHand=purchased-sold
| table OS InHand

upvote if my answer solves your problem.

[sstanlee]

I didn't get the results.  

<Index Search>| 

in verbose mode returns 

1. OS=Win Category=purchased Numbers=100

2. OS=Unix Category=purchased Numbers= 200

3. OS=Win Category=sold Number=50

4. OS=Unix Category=sold Number=125

My search scenario is, if OS is Windows, I want to calculate the remaining count which is purchased - sold. How to do this.

[thambisetty]

I have shared query for the values you posted. I tried before posting and its working 

[sstanlee]

I had more than 100 lines of data, but I quoted few as example.Initially it didnt work. I modified few of your code and it worked.  Thanks a lot. 

[to4kawa]

index=_internal | head 1
| fields _raw _time
| eval _raw="1. OS=Win Category=purchased Numbers=100
2. OS=Unix Category=purchased Numbers=200
3. OS=Win Category=sold Number=50
4. OS=Unix Category=sold Number=125"
| multikv noheader=t
| fields _raw _time
| kv
| rename COMMENT as "this is your sample"

| eval Numbers=coalesce(Numbers,-1 * Number)
| stats sum(Numbers) as "InHand(purchased-sold)" by OS

[sstanlee]

It worked. Thanks a lot.