Splunk Search

## How do i subtract values from the same field and table results by another field in this case Field B

Explorer

How do i subtract values from the same field and table results by another field in this case Field B

subtract 400 - 200 for value 1
and 300 - 200 for value 2

FieldA FieldB FieldC
200 value1 may-2-2018
300 value2 June-2-2018
400 value1 may-2-2018
200 value2 Jun2-2-2018

Tags (5)
1 Solution
Champion

Great, then I think this should do it for you:

``````base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC
``````
Explorer

i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB

Thanks elliotproebstel, i got a clue when you mentioned Max and Min

Motivator

hey Bentash,

Champion

Champion

Great, then I think this should do it for you:

``````base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC
``````
Champion

How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.

Explorer

i correct 300-300 its a type.. and i am determining the results for Value1 and 2 because i want to get the difference between those two result sets since that are coming from different dates

Explorer

i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB

Thanks elliotproebstel, i got a clue when you mentioned Max and Min