Simple subtraction between two searches

[Fo]

I have two very simple searches and I need to be able to get the difference. This is insanely hard for something that is so simple. 

search index="first-app" sourcetype="first-app_application_log"
AND "eventType=IMPORTANT_CREATE_EVENT" | stats count

^ this result is 150

search index="second-app" sourcetype="second-app_application_log"
AND "eventType=IMPORTANT_CANCEL_EVENT" | stats count

^ this result is 5

I'm trying to figure out how to simply do the 150 - 5 to get 145. I've tried `set diff` `eval` a bunch of different ways with no luck. I'm going nuts.

Any help would be greatly appreciated!

[gcusello]

Hi @Fo,

please try something like this:

(index="first-app" sourcetype="first-app_application_log"  "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
   count(eval(index="first-app")) AS "first_app"
   count(eval(index="second-app")) AS "second_app"
| eval diff="first_app"-"second_app"
| table diff

One additional hint: don't use minus char in field names because Splunk knows it as the minus sign, use underscore (_).

Ciao.

Giuseppe

[gcusello]

Hi @Fo ,

as hinted by @ITWhisperer it was a mistyping for this reason I hinted to avoid the minus char!

(index="first-app" sourcetype="first-app_application_log"  "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
   count(eval(index="first-app")) AS "first_app"
   count(eval(index="second-app")) AS "second_app"
| eval diff=first_app-second_app
| table diff

Ciao.

Giuseppe

[ITWhisperer]

Correction to @gcusello 's suggestion - when you quote field names on the righthand side of an evaluation, you need to use single quotes not double quotes (otherwise, Splunk treats them as strings and you can't subtract on string from another as they are not numeric data types)

(index="first-app" sourcetype="first-app_application_log"  "eventType=IMPORTANT_CREATE_EVENT") OR (index="second-app" sourcetype="second-app_application_log" "eventType=IMPORTANT_CANCEL_EVENT")
| stats
   count(eval(index="first-app")) AS "first_app"
   count(eval(index="second-app")) AS "second_app"
| eval diff='first_app'-'second_app'
| table diff