How to add a new row to my table that subtracts the counts of two fields from the count of another field?

[allanmb]

I have simple table as shown below

• Msg | Count Completed Stage 1 | 975 Completed Stage 2 | 750 Hit Quit | 200

I want to be able to add a new row which takes the count of "Completed Stage 1" and subtracts the count of "Hit Quit" and subtracts the count of "Completed Stage 2" to give me another row like this:

• Assumed Network Error | 25

How can I achieve this? I tried several combinations including this, but I can't get the result I want:

eval NetError = count("Completed Stage 1")  - count("Hit Quit") - count("Completed Stage 2")  | rename NetError as "Assumed Network Error"

Thanks

[somesoni2]

Give this a try

your current search giving above table 
| appendpipe [| eval temp=1 | chart sum(Count) over temp by Msg |eval Msg="Assumed Network Error" | eval Count== 'Completed Stage 1' -'Hit Quit'-'Completed Stage 2' | table Msg Count  ]

[allanmb]

I gave this a try and it didn't work. Instead of my table I was getting a page that looked like all the events with many fields

[javiergn · Accepted solution]

Hi,

Give this a go:

your table search here
| eval temp_count = case (match(Msg, "Completed Stage 1"), Count, match(Msg, "Completed Stage 2"), -Count, match(Msg, "Hit Quit"), -Count)
| addcoltotals fieldname=temp_count
| eval Msg = coalesce(Msg, "Assumed Network Error")
| eval Count = if (match(Msg, "Assumed Network Error"), temp_count, Count)
| fields - temp_count

Regards,
Javier

[allanmb]

Thanks I got this working nice and easily