@preacher_15 ,
Try
index="your index" source="first" OR source="second"
|fields Lead,Actuals,Budget,Forecast,NotActuals, NotForecast, NotBudget
|addcoltotals labelfield="Lead" label="Total"
|eventstats first(NotActuals) as NotActuals,first(NotForecast) as NotForecast,first(NotBudget) as NotBudget
|eval Actuals = if(Lead=="Total", Actuals-NotActuals,Actuals) ,
Forecast = if(Lead=="Total", Forecast-NotForecast,Forecast) ,
Budget = if(Lead=="Total", Budget-NotBudget,Budget)
|fields Lead,Actuals,Budget,Forecast|where isnotnull(Lead)
With dummy data ,
|makeresults |eval Lead="A B"|makemv Lead|mvexpand Lead|appendcols [|makeresults|eval Actuals="10 15"|makemv Actuals|mvexpand Actuals]
|appendcols [|makeresults |eval Forecast="20 15"|makemv Forecast|mvexpand Forecast]
|appendcols [|makeresults |eval Budget="200 300"|makemv Budget|mvexpand Budget]
|append [|makeresults |eval Name="OtherCosts", NotActuals="30", NotForecast="30", NotBudget="400" ]
|rename COMMENT as "<--Until here is dummy data generation and should not used in the -->"
|fields Lead,Actuals,Budget,Forecast,NotActuals, NotForecast, NotBudget
|addcoltotals labelfield="Lead" label="Total"
|eventstats first(NotActuals) as NotActuals,first(NotForecast) as NotForecast,first(NotBudget) as NotBudget
|eval Actuals = if(Lead=="Total", Actuals-NotActuals,Actuals) ,
Forecast = if(Lead=="Total", Forecast-NotForecast,Forecast) ,
Budget = if(Lead=="Total", Budget-NotBudget,Budget)
|fields Lead,Actuals,Budget,Forecast|where isnotnull(Lead)
... View more