compare the number of events from 2 subsearches in different indexes

[imrago]

I would like to create an alert if the number on events is different in two subsearches.

subsearch1 = "index=index1 | dedup checksum | stats count"

subsearch2 = "index=index2 | dedup checksum | stats count"

unsuccessful attempts: 1) using subsearch

index=index1 | dedup checksum | stats count | search count > [search index=index2 | dedup checksum |stats count | search count]

2) using set diff

set diff [search index=index1 | dedup checksum] [search index=index2 | dedup checksum]

[gkanapathy · Accepted solution]

index=index1 OR index=index2 | dedup index,checksum | stats count by index | eval nevents="nevents" | xyseries index nevents count | where index1!=index2

Update:

Actually now that I think about it, this may be clearer and more generally useful:

index=index1 OR index=index2 | dedup index,checksum | stats count(eval(index=="index1")) as index1count, count(eval(index=="index2")) as index2count | where index1count!=index2count