I would like to add a column to a chart that is the difference of the two columns before it in an application where I am showing the Cost for each employee for the last 2 weeks. Using the search:
index=SampleData
| where _time>relative_time(now(),"-2w@w")
| convert timeformat="%m-%d-%Y" ctime(_time)
| chart sum(Cost) over Employee by _time
The above produces a chart that looks like the following
Employee 05-08-2022 05-15-2022
Employee1 100.00 150.00 Employee2 200.00 175.00
How can I add a column at the end that shows the difference between the two weeks?
... View more