Hi guys,
I'm having trouble making a simple subtraction (well, I thought it would be simple!). Field1 is a number in string format, Field2 is a count of events. What am I doing wrong?
index=index_name | convert num(Field1) as Field1Total | stats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference
Thanks for your help!
Automatically convert the fields to a number using the best conversion.
convert
use conversion .
If you want to modify to number, simply tonumber()
the problem is that after stats command you have only the fields the are in the stats, in your example you have only Field1Total, probably you have to use evenstats command or the values option of stats.
index=index_name
| eventstats count(Field2) as Field2Total
| eval Difference=Field2Total - Field1Total
| table Difference
or
index=index_name
| stats count(Field2) as Field2Total values(Field1) as Field1Total
| eval Difference=Field2Total - Field1Total
| table Difference
Ciao.
Giuseppe