How to get results of two searches and compare them?

[sheldonkooper]

i have two searches:

earliest=-10m index=perfmon server=web1  sourcetype="Perfmon:CPUTime" | stats avg(Value) as CPUUtilisation | sort -CPUUtilisation | stats first(CPUUtilisation)

and

earliest=-10m index=perfmon server=web2 sourcetype="Perfmon:CPUTime" | stats avg(Value) as CPUUtilisation | sort -CPUUtilisation | stats first(CPUUtilisation)

I got the Search 1 result as 25.5 and Search 2 result as 30.5
1. How do i compare these two values like "search2-search1=5" or "search2+search1=56"?
2. can i store search1, search2 values in some variable like $result1 ,$result2

[woodcock · Accepted solution]

This will do it:

earliest=-10m index=perfmon sourcetype="Perfmon:CPUTime" |stats avg(Value) as CPUUtilisation| sort -CPUUtilisation|stats first(CPUUtilisation) BY server | transpose | search column ="count" | eval sum = $row 1$ + $row 2$ | eval diff = $row 1$ - $row 2$

[sheldonkooper]

got the idea. Thanks 🙂