How to subtract outcome of count

[rijk]

I have two saved searches, saved them as macros.

1: [search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed cc* | stats count

This is saved as brem_correction_count

2: [search sourcetype="brem" sanl31 eham Successfully completed (cc*) | fields MessageTime] sanl31 eham Successfully completed NOT cc* | stats count

This is saved as brem_corrected_count

How can I use these searches to subtract the outcome of the 2 searches?

[rijk]

Many thanks for you answer, it does exactly what I needed. The subsearch is needed to find two related messages based on a field MessageTime. Sorry that I confused you, but the subsearch is needed.

[lguinn2 · Accepted solution]

First, I don't understand what the subsearch is doing in either one of these. I think you can simplify like this:

Search 1:

sourcetype="brem" sanl31 eham Successfully completed cc* | stats count

Search 2:

sourcetype="brem" sanl31 eham Successfully completed NOT cc* | stats count

The fastest search that would calculate the difference would probably be

sourcetype="brem" sanl31 eham Successfully completed
| eval ccType=if(match(_raw,"\bcc"),"Yes","No")
| stats count(eval(ccType="Yes")) as ccCount count(eval(ccType="No")) as NotCcCount
| eval diff =ccCount - NotCcCount