Splunk Search
Highlighted

How can I build a chart that show the difference between two fields?

New Member

index=app sourcetype=application1 source=server1production with this search I get back two field Baseprice and finalprice. How can I build a chart that show the difference between finalprice and baseprice?

Tags (3)
0 Karma
Highlighted

Re: How can I build a chart that show the difference between two fields?

SplunkTrust
SplunkTrust

are those numeric fields? meaning are the values for these fields are numbers?
if so, try this ... your search ... | eval diff = finalprice - baseprice | chart ...

0 Karma
Highlighted

Re: How can I build a chart that show the difference between two fields?

Champion

not cleat what you want, I am guessing you want some sort of final price (y axis) over baseprice(xaxis) and also the difference.
If so, try this |chart values( finalprice) by baseprice| eval diff=finalprice-baseprice
Use format option in visualization > select diff as chart overlay
But as @adonio says, are your fields numerical?

0 Karma