Subtract One Field from Another

[driva]

Hi guys,

I'm having trouble making a simple subtraction (well, I thought it would be simple!). Field1 is a number in string format, Field2 is a count of events. What am I doing wrong?

index=index_name | convert num(Field1) as Field1Total | stats count(Field2) as Field2Total | eval Difference=Field2Total - Field1Total | table Difference

Thanks for your help!

[to4kawa]

Convert

Automatically convert the fields to a number using the best conversion.
convert use conversion .

If you want to modify to number, simply tonumber()

[gcusello]

the problem is that after stats command you have only the fields the are in the stats, in your example you have only Field1Total, probably you have to use evenstats command or the values option of stats.

 index=index_name 
| eventstats count(Field2) as Field2Total
| eval Difference=Field2Total - Field1Total 
| table Difference

or

 index=index_name 
| stats count(Field2) as Field2Total values(Field1) as Field1Total
| eval Difference=Field2Total - Field1Total 
| table Difference

Ciao.
Giuseppe