It is possible if we can match every value in the table with all the values and then give the results

[soundv]

Hi,
i have a query on which i am stuck now from multiple days. I have combined 2 queries , first one gives the total value of eligible users and second one gives the total value of eligible users who completed the process of downloading esim profile and it is based on IMSIs values.
At the end i want the result of total number of eligible users - total number of eligible users who completed the process, not only the count but the IMSIs as well.

| fields - count] 

| table IMSI1 IMSI2
| stats count(IMSI1) as IMSI1 count(IMSI2) as IMSI2
|eval diff=IMSI1-IMSI2

it gives me count, but not the IMSIs value. It is possible if we can match single value in the table with all the values and then give the results. Something like below, then i will able to figure out the result of my final query-

Table 1 Table 2 Result
1 2 1
2 5 match
3 7 3
4 4
5 match
6 6
7 match
8 8

[woodcock]

What you have given is unclear to me. This will be almost impossible to answer unless you do the following:
Give sample events with fields labeled.
Show us a mockup of the desired final output.

[harishalipaka]

hi @soundv

try this ..if you want sum

|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,7.10"   | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2 
| eventstats sum(IMSI1) as sum_IMSI1,sum(IMSI2) as sum_IMSI2 |eval diff=sum_IMSI1-sum_IMSI2

Or count od IMSIs try this

|makeresults |eval IMSI1="1.12,9.54,4.1,6.8,5.52,3"   | makemv delim="," IMSI1 | mvexpand IMSI1 | rex field=IMSI1 "(?<IMSI1>\d).(?<IMSI2>\d+)" | table IMSI1 IMSI2 
| eventstats count(IMSI1) as count_IMSI1,count(IMSI2) as count_IMSI2 |eval diff=count_IMSI1-count_IMSI2

[vishaltaneja070]

Hello @soundv,

I have tried it with my data, are you looking something like this:

index=*  source="WinEventLog:Security" | stats  count by category | eval [ search index=* | stats count | rename count as count2 | return count2]  | eval Diff= count2 - count | fields - count, - count2

[chrisyounger]

are you able to provide a bit more sample data?