Splunk Search

Can I have the difference of two values as the output using appendcols? How?

jsuryaprakash
Path Finder

index=main (sourcetype=bb OR sourcetype=cc) type=DELETE | transaction info.agentId startswith=COMPLETED endswith=DELETE keepevicted=true | search closed_txn=0 type=DELETE | stats count(info.agentId) AS "Deleted Device"
| appendcols [search index=main(sourcetype=bb OR sourcetype=cc ) type=COMPLETED OR type=DELETE| transaction info.agentId startswith=COMPLETED endswith=DELETE keepevicted=true | search closed_txn=0 type!=DELETE | stats count(info.agentId) AS "Onboarded Devices" ]

My outcome is:

Deleted Device   Deleted Device
151              155

But I need the difference as below.
Total Devices
4

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's a completed untested query that avoids appendcols.

index=main(sourcetype=bb OR sourcetype=cc ) type=COMPLETED OR type=DELETE| transaction info.agentId startswith=COMPLETED endswith=DELETE keepevicted=true | search closed_txn=0  | stats count(eval(type=DELETE)) AS "Deleted Device" count(eval(type!=DELETE)) AS "Onboarded Devices"  | eval "Total Devices"='Onboarded Devices' - 'Deleted Device'
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...