I have a timechart from the command timechart span=1d count by skill1 which looks like this:
_time | VALUE1 | VALUE2 | VALUE3 | VALUE4 |
2021-09-15 | 77 | 243 | 17 | 28 |
2021-09-16 | 80 | 104 | 65 | 22 |
And another timechart from the command timechart span=1d count by skill2 which looks like this:
_time | VALUE1 | VALUE2 | VALUE3 | VALUE4 |
2021-09-15 | 70 | 200 | 10 | 12 |
2021-09-16 | 56 | 87 | 54 | 11 |
I want to create a new timechart which should have skill1's values - skill2's values. As follows:
_time | VALUE1 | VALUE2 | VALUE3 | VALUE4 |
2021-09-15 | 7 | 43 | 7 | 16 |
2021-09-16 | 14 | 17 | 11 | 11 |
I tried using the command:
timechart span=1d count by skill1-skill2
But it won't work.
Any suggestions on how to create the new timechart?
Alternatively if you can share your data selection part of the search, it can probably be done using subsearches to join the two data sets together.
You can do this type of timechart with eval and then calc the differences afterwards, but that my not work unless you know and can code in all the values of skill
| makeresults count=1000
| eval _time=_time-(random() % 7)*86400
| eval skill1=mvindex(split("Value1,Value2,Value3,Value4",","), random() % 4)
| eval skill2=mvindex(split("Value1,Value2,Value3,Value4",","), random() % 4)
| timechart span=1d sum(eval(if(skill1="Value1", 1, 0))) as s1v1 sum(eval(if(skill1="Value2", 1, 0))) as s1v2 sum(eval(if(skill1="Value3", 1, 0))) as s1v3 sum(eval(if(skill1="Value4", 1, 0))) as s1v4 sum(eval(if(skill2="Value1", 1, 0))) as s2v1 sum(eval(if(skill2="Value2", 1, 0))) as s2v2 sum(eval(if(skill2="Value3", 1, 0))) as s2v3 sum(eval(if(skill2="Value4", 1, 0))) as s2v4
| eval v1=s1v1-s2v1, v2=s1v2-s2v2, v3=s1v3-s2v3, v4=s1v4-s2v4
| table _time v*
Just paste in this to the search window
Hi @bowesmana
This is producing results, but the difference is wrong