difference of two counts

[lain179]

chart count(IN), count(OUT), count(EXP) by SERVER

I also want to include the calculated value of count(IN)-count(OUT)-count(EXP) on the column chart. How can I include that calculation?

Thanks!

[sdaniels · Accepted solution]

I can't try it right now but it probably looks like this:

<search> | stats count(IN) as inCount, count(OUT) as outCount, count(EXP) as expCount by SERVER | eval calcField = inCount - outCount - expCount | chart inCount, outCount, expCount, calcField by SERVER

[lain179]

Thanks. That way works!