Answers for "How to subtract 2 row sum total value"
https://answers.splunk.com/answers/583088/how-to-subtract-2-row-sum-total-value.html
The latest answers for the question "How to subtract 2 row sum total value"Answer by kamlesh_vaghela
https://answers.splunk.com/answering/583097/view.html
Hi @yograjpatel,
Can you please try below search??
index=elm-***
| dedup transactionid
| eval amount=round(amount/100,2)
| stats sum(eval(if(actioncode=="DP",amount,0))) as DP sum(eval(if(actioncode=="RF",amount,0))) as RF
| eval difference = DP - RF
ThanksWed, 18 Oct 2017 17:10:56 GMTkamlesh_vaghela