How do you subtract values from an appended search?

[jephillips]

I'm trying to run the below searches and get the subtracted value from them. However, the eval command is not giving me a new Difference field. I just get the results of the separate searches.

index=a sourcetype=test start=* end=* | eventstats count as Total1
| append [search index=a sourcetype=test start=* end=* xfer=* | eventstats count as Total2]
| eval Difference=Total1 - Total2

I'd like a chart that with a row for all three values.

Total1        Total2          Difference
10               8                   2

[Vijeta]

You can try the below search-

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

[vishaltaneja070 · Accepted solution]

Hello @jephillips ,

Try this:

index=a sourcetype=test start= end= | stats count as Total1
| appendcols [search index=a sourcetype=test start= end= xfer=* | stats count as Total2]
| eval Difference=Total1 - Total2

[jephillips]

That did it! Thanks for the help.

[woodcock]

Be sure to click Accept to close the question and help others find working answers.

[vishaltaneja070]

@jephillips
Great 🙂

Please accept the answer to close the thread.