Combine results of 2 searches to perform math on results

[tkwaller_2]

Hello

I have 2 searches that i want to do math on the results. Each search looks for a specific string and dedups based on an id. 

The first search:

index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count

the second search:

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count

What I'd like to be able to do is take the results from the first set and subtract the second. for example if the first set was 1000 and the second was 500 I'd like to be able to show the difference. At some point I'd like to be able to show the id's that were in the first set that were not in the second and show that in a panel.

Thanks for the assistance!

[tkwaller_2]

worked great, thanks!

[ITWhisperer · Accepted solution]

Try something like this

index=anon_index source="*source.log" "message was published to * successfully"
| dedup MSGID
| append [search index="index2"  "ROUTING failed.  Result sent to * response queue  tjhis.MSG.RES.xxx" source=MSGTBL* OR source=MSG_RESPONSE OR source=*source.log
| dedup MSGID]
| stats count as firstcount
| appendcols
[ search index=anon_index source="*source.log"  "call to ODM at */file_routing"
| dedup MSGID
| stats count as secondcount]
| eval diff=firstcount-secondcount