How do i subtract values from the same field and table results by another field in this case Field B

[Bentash]

How do i subtract values from the same field and table results by another field in this case Field B

subtract 400 - 200 for value 1
and 300 - 200 for value 2

FieldA FieldB FieldC
200 value1 may-2-2018
300 value2 June-2-2018
400 value1 may-2-2018
200 value2 Jun2-2-2018

[Bentash]

i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB

Thanks elliotproebstel, i got a clue when you mentioned Max and Min

[deepashri_123]

hey Bentash,

Please accept the answer by elliotproebstel to close the question.

[elliotproebstel]

Glad to help!

[elliotproebstel · Accepted solution]

Great, then I think this should do it for you:

base search that gets you the table above
| stats max(FieldA) AS max_FieldA min(FieldA) AS min_FieldA BY FieldB FieldC
| eval FieldA=max_FieldA-min_FieldA
| fields FieldA FieldB FieldC

[elliotproebstel]

How are you determining 400-200 for value1 and 300-300 for value2? It looks like max(FieldA) - min(FieldA) for value1, but why 300-300 for value2? If the logic is generalizable, I can help you write the query.

[Bentash]

i correct 300-300 its a type.. and i am determining the results for Value1 and 2 because i want to get the difference between those two result sets since that are coming from different dates

[Bentash]

i actually got this working .. i |stats max("FieldA") as MaxAppInstall min("FieldA") as MinAppInstall range("FieldA") as Difference by FieldB

Thanks elliotproebstel, i got a clue when you mentioned Max and Min