How to display the difference between the results from two different searches?

[thewho123]

I display two different graphs by using the following strings.

"Sending" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes sent"

"Receiving" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes received"

I can display both in the same graph by:

"Sending" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) AS "Gigabytes sent" | appendcols [search "Receiving" earliest=-7days | eval gigabytes=((bytes/1024)/1024) | timechart  span=1day avg(gigabytes) AS "Gigabytes received"]

This gives me two lines (each has a value for one day for the past 7 days).

How do I display the difference between gigabytes sent and received? I want to display Gigabytes sent - gigabytes received for each day for the past 7 days.

[sundareshr · Accepted solution]

Try this

"Sending" OR "Receiving" earliest=-7days | rex  "(?<action>Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving

[thewho123]

Is the syntax correct? I get null for y-axis description.

Also avg bytes from sending and receiving should be separate. Wouldn't this combine all of them together ?

[sundareshr]

Do you not see columns for Sending and Receiving? The avg(gb) will be calculated separately for each action. If NULL is the third column, you could add usenull=f to the timechart command. You search would look like this

index=myIndex sourcetype=mySourcetype "Sending" OR "Receiving" earliest=-7d@d | rex  "(?<action>Sending|Receiving)" | eval gigabytes=((bytes/1024)/1024) | timechart usenull=f span=1day avg(gigabytes) as gb by action | eval diff=Sending-Receiving