I have two very simple searches and I need to be able to get the difference. This is insanely hard for something that is so simple.  search index="first-app" sourcetype="first-app_application_log" AND "eventType=IMPORTANT_CREATE_EVENT" | stats count ^ this result is 150 search index="second-app" sourcetype="second-app_application_log" AND "eventType=IMPORTANT_CANCEL_EVENT" | stats count ^ this result is 5 I'm trying to figure out how to simply do the 150 - 5 to get 145. I've tried `set diff` `eval` a bunch of different ways with no luck. I'm going nuts. Any help would be greatly appreciated! ... View more