How to calcualte the count diff between 2 searches?

[jerrytao]

index=A | stats count as count1
index=A | dedup field1 field2 | stats count as count2

This 2 searched have same index A, then I want to calculate (count1-count2).

Anyone can help on this? Thanks in advance!

[vnravikumar · Accepted solution]

Hi

Try this

index=A | stats count as count1
| appendcols 
    [| search index=A | dedup field1 field2 | stats count as count2] |eval diff = count1-count2