I would like to add a column to a chart that is the difference of the two columns before it in an application where I am showing the Cost for each employee for the last 2 weeks.   Using the search: index=SampleData  | where _time>relative_time(now(),"-2w@w") | convert timeformat="%m-%d-%Y" ctime(_time) | chart sum(Cost) over Employee by _time The above produces a chart that looks like the following Employee        05-08-2022     05-15-2022 Employee1      100.00             150.00 Employee2      200.00             175.00 How can I add a column at the end that shows the difference between the two weeks? ... View more

I am looking to search in one Index for a specific field name and then use a second field from that Index to search a second Index for that value.  For example IndexA has field names Project and IRNumber / IndexB has a field named InternalRequest IRNumber in Index A and InternalRequest in IndexB are the same values I would like to search IndexA by Project and then use the associated IRNumber from IndexA to search IndexB for the InternalRequest with the same value and then table various values from IndexB associated with that InternalRequest value.  Is there some way to use a sub-search to do this? ... View more