How to subtract 2 row sum total value

[yograjpatel]

How to get the Total difference amount from DP - RF

Search used:
index=elm-*** | dedup transactionid | eval amount=round(amount/100,2) | stats sum(amount) as Total by actioncode

actioncode  Total
DP              19460.63
RF                   595.14

[kamlesh_vaghela · Accepted solution]

Hi @yograjpatel,

Can you please try below search??

index=elm-*** 
| dedup transactionid 
| eval amount=round(amount/100,2) 
| stats sum(eval(if(actioncode=="DP",amount,0))) as DP sum(eval(if(actioncode=="RF",amount,0))) as RF 
| eval difference = DP - RF

Thanks

[yograjpatel]

thanks Kamlesh... it worked