I have 2 keywords.
"UniSim Job received" and "UniSim Job Run completed successfully".
I want to find the difference between the count of these 2 keywords.
Can you please share some more information?? like, what are your events and what is your expected output.
try this, replace "action" with your field name
|stats count(eval(action="UniSim Job received")) as abc count(eval(action="UniSim Job Run completed successfully")) as abcd | eval diff=abc-abcd
View solution in original post