Splunk Search

How to subtract 2 row sum total value

New Member

How to get the Total difference amount from DP - RF

Search used:
index=elm-*** | dedup transactionid | eval amount=round(amount/100,2) | stats sum(amount) as Total by actioncode

actioncode  Total
DP              19460.63
RF                   595.14
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi @yograjpatel,

Can you please try below search??

index=elm-*** 
| dedup transactionid 
| eval amount=round(amount/100,2) 
| stats sum(eval(if(actioncode=="DP",amount,0))) as DP sum(eval(if(actioncode=="RF",amount,0))) as RF 
| eval difference = DP - RF

Thanks

View solution in original post

SplunkTrust
SplunkTrust

Hi @yograjpatel,

Can you please try below search??

index=elm-*** 
| dedup transactionid 
| eval amount=round(amount/100,2) 
| stats sum(eval(if(actioncode=="DP",amount,0))) as DP sum(eval(if(actioncode=="RF",amount,0))) as RF 
| eval difference = DP - RF

Thanks

View solution in original post

New Member

thanks Kamlesh... it worked

0 Karma