index=oswindows sourcetype="winhost" host=npe OR host=npw source=service earliest="-30d@d" latest="@d DisplayName="Vontu Monitor"
| transaction DisplayName !(startswith="State=Stopped" endswith="State=Running")
| stats sum(duration) as abc1 by host,DisplayName
index=oswindows sourcetype="winhost" host=npe OR host=npw source=service earliest="-30d@d" latest="@d" DisplayName="Vontu Monitor"
| transaction DisplayName startswith="State=Stopped" endswith="State=Running"
| stats sum(duration) as abc2 by host, DisplayName
What I want is to substract the first sum of value by host for first search with second search. Please help me. I tried append and appendcols but it doesn't display the second search result.
... View more