Give this a try | rest /services/admin/LDAP-groups splunk_server=abc | mvexpand roles | search roles=admin_user | stats count by users | table users| eval from="admin_users1" | append [| rest /services/admin/LDAP-groups splunk_server=xyz | mvexpand roles | search roles=admin_user | stats count by users | table users | from="admin_users2"] | stats values(from) as from_combined by users | eval type=case(mvcount(from_combined)=2,"admin_users1 admin_users2", from_combined="admin_users1","In user1 only", true(), "In user2 only") | makemv type | mvexpand type | eval temp=1 | table temp type users | chart values(users) over temp by type ... View more

Try clearing the cache and then reloading the page. See https://answers.splunk.com/answers/659194/how-do-i-clear-the-cache-to-see-the-changes-after-1.html I suspect that Splunk is caching some old Javascript (this is pretty common problem). ... View more

I used | eval Year_Month = strftime(_time, "%Y-%m") to get months like 2017-12, 2018-01, 2018-02 To get first and last month, | eventstats first(Year_Month) as first, last(Year_Month) as last Now if I do | foreach * [eval Growth='2017-12' - '2018-02'] it works But variable substitution not working | foreach * [eval Growth='first' - 'last'] ... View more