Calculate Difference Between Outputs of two Scheduled Searches

[jodros]

I have two scheduled searches that each output a single numerical value to populate panels on a dashboard. I want to add a third panel to simply show the difference between the two. I have read several threads on splunk answers but none have helped me with this issue. Each search is somewhat complex and takes a bit of time to run, so I scheduled them to run and cache their results for the dashboard. I have read and tried using savedsearch and append. I have also tried to utilize OR and eval. I have read where using join is discouraged. Best case would be to simply take the already ran results and simply eval them, without have to run both searches again.

Any assistance would be appreciated. Thanks.

Edit:
Would it help if I included the searches that are running on a schedule?
Search 1:

`sourcetype=a tag=prod | dedup c_uid | stats count(c_uid)`

Search 2:

`sourcetype=a tag=prod [search sourcetype=b tag=prod audit_event="AUTHN_SUCCESS" | dedup b_uid | fields b_uid | format maxresults=20000] | dedup c_uid | stats count(c_uid)`

Search 1 will always be more than search 2, and I would like to show that difference in a panel on the dashboard. The other alternative is not to show the difference and just let the VP do the math, which isn't a good option.

Thanks!

[Ayn · Accepted solution]

I think this should work:

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | delta count(c_uid) as diff

This will create the field "diff" that you could show in a panel.

[flo_cognosec]

Interesting enough I can't seem to find the necc. job-id's and when using the names of scheduled saved searches, I get the error message that no search artifacts could be found even though the searches ran and can be viewed.
Is a stats command in the saved searches a problem ?

[jodros]

Thank you! I knew it would be something simple like that. I modified your suggestion slightly but it works great.

| loadjob savedsearch="user:app:yoursavedsearch" | append [| loadjob savedsearch="user:app:yourothersavedsearch"] | stats range(count(c_uid) as diff

This allows me not to have to worry about negative integers.