How to assign subsearches to multiple fields and evaluate their additions/subtractions

[tunchi]

I have a base search and there are multiple events that I can find depending on some set of the subtstring. Let's say A, B, C

I just want to get the counts of these events and calculate a single result from them.

This is what I got so far:

basesearch  |  stats count(eval(searchmatch("A should contain"))) as successA,
stats count(eval(searchmatch("B should contain"))) as failureB,
stats count(eval(searchmatch("C should contain"))) as failureC,
| eval overall = successA - failureB - failureC
| stats count by overall

...needless to say, it does not work.
Any simple ideas out there?

It's a very simple and basic question but I cannot find any entry or valid answer.
I appreciate any help.

Thanks,
Tunch

[aberkow]

Your main issue is that you only need to make one stats call, regardless of the number of functions you apply to it. Example:

basesearch
| stats count(x) as y, values(y) as z, avg(num) as avgNum

is valid Splunk, whereas yours is not. Another way you could've noticed this is by turning on syntax highlighting under your settings (click your name in the top right corner of the Splunk UI -> Preferences -> SPL Editor, Turn on Advanced Editor). I also like dark mode as my theme.

Let me know if I'm answering the wrong question, unclear what is pseudo code and real code in your search. Happy to take another shot if this doesn't work!