| action | feature | version | location | count | ?difference? |
| A | f1 | v1 | WA | 120 | 0 |
| A | f1 | v1 | OR | 110 | 10 |
| A | f1 | v1 | CA | 115 | 5 |
| B | f1 | v1 | AZ | 120 | 0 |
| A | f1 | v2 | WA | 14 | 1 |
| A | f1 | v2 | OR | 10 | 5 |
| B | f1 | v2 | AZ | 15 | 0 |
I got a table of info above: action, feature, version, location, and count. Could anyone help me to find the last column "difference" here?
A group is identified by same feature and version combination. so in the example table, the first four rows(f1+v1) are one group, and the last three rows(f1+v2) are the second group.
within each group, difference = count B - count A.
for example:
row1, difference = count (B, f1, v1, AZ) - count (A, f1,v1,WA) = 120-120=0
row2, difference = count (B, f1, v1, AZ) - count (A, f1,v1,OR) = 120-110=10
difference of countB itself is 0.
You may try
"Your current search"
|eventstats max(eval(if(action=="B",count,null()))) as action_b by feature,version
|eval difference=action_b - count
Run anywhere example
| makeresults |eval action="A A A B A A B"|makemv action|mvexpand action
|appendcols[|makeresults |eval feature="f1 f1 f1 f1 f1 f1 f1"|makemv feature| mvexpand feature]
|appendcols[|makeresults |eval version="v1 v1 v1 v1 v2 v2 v2"|makemv version| mvexpand version]
|appendcols[|makeresults |eval location="WA OR CA AZ WA OR AZ"|makemv location| mvexpand location]
|appendcols[|makeresults |eval count="120 110 115 120 14 10 15"|makemv count| mvexpand count]
|fields - _time
|rename COMMENT as "Ignore above data similution search"
|eventstats max(eval(if(action=="B",count,null()))) as action_b by feature,version
|eval difference=action_b - count
|fields action,feature,version,location,count,difference