index=A | stats count as count1
index=A | dedup field1 field2 | stats count as count2
This 2 searched have same index A, then I want to calculate (count1-count2).
Anyone can help on this? Thanks in advance!
Hi
Try this
index=A | stats count as count1
| appendcols
[| search index=A | dedup field1 field2 | stats count as count2] |eval diff = count1-count2
Hi
Try this
index=A | stats count as count1
| appendcols
[| search index=A | dedup field1 field2 | stats count as count2] |eval diff = count1-count2