How do i subtract values from the same field and table results by another field in this case Field B
subtract 400 - 200 for value 1
and 300 - 200 for value 2
FieldA FieldB FieldC
200 value1 may-2-2018
300 value2 June-2-2018
400 value1 may-2-2018
200 value2 Jun2-2-2018
Great, then I think this should do it for you:
base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC
i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB
Thanks elliotproebstel, i got a clue when you mentioned Max and Min
hey Bentash,
Please accept the answer by elliotproebstel to close the question.
Glad to help!
Great, then I think this should do it for you:
base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC
How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.
i correct 300-300 its a type.. and i am determining the results for Value1 and 2 because i want to get the difference between those two result sets since that are coming from different dates
i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB
Thanks elliotproebstel, i got a clue when you mentioned Max and Min