@jamesbabugm  You can eval the diff between total a & total b and then rename fields. Like index!= "internal " sourcetype="a" "messagea" | stats count as a | appendcols [search index!= "internal" sourcetype="b" "messageb" | stats count as b ] | appendcols [search index!= "internal" sourcetype="c" "messagec" | stats count as c ] | eval diff = a - b | table a b c diff | rename a as "Total of Message a", b as "Total of Message b", c as "Total of Message c", diff as "Diff of Total a and Total b"   You can change the search as per your requirement.   https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Eval https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rename   I hope this will help you. Thanks KV If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated. ... View more