Getting values from a field and comparing them

[mauricio2354]

I have the following query:

index=source sourcetype=type_example | bin _time span=5m| eval TIME=strftime(_time,"%D:%H:%M") | search (CountryCode="US") | eval transaction_type=case( searchmatch(" eventName=event1 OR eventName=event2") , "Example Info" ) | eval series=ProductDescription."/".transaction_type | where statusCode="1" | chart count as total_count over TIME | tail 2

When I run this query over the past 5 minutes, it gives me a table with two volume results for two time periods, like so:

I want to assign those two values (211 and 204) to two different variables (count1 and count2), so that I can end up with another result. In the end, I want two more values, count3 = count1 - count2, and count4 = .3 * count1.

Please help, I've been stuck on this forever 😞

Thank you!

[mayurr98 · Accepted solution]

Try this

<your query so far with columns TIME and total_count>
| sort - total_count 
| transpose column_name=TIME 
| search TIME=total_count 
| rename "row *" as count* 
| eval count3=count1-count2,count4=round(.3*count1,2)

let me know if this helps!

[mauricio2354]

This helped immensely, thank you so much!