I have the below queries, would like to run together and subtract the count results. Any help appreciated.
|host=SMD* source="D:\Apps\CM\Logs\CM_" "Removing Session" AND "CM_EMD"
| rex field=_raw "(?.+)"
| rex field=_raw "(?.+)"
| convert timeformat="%d" ctime(_time) AS c_time
| table c_time Server UserName count
| dedup c_time Server UserName | stats count by c_time Server
and
|host=SMD* source="D:\Apps\CM\Logs\CM_" "Adding Session" AND "CM_EMD"
| rex field=_raw "(?.+)"
| rex field=_raw "(?.+)"
| convert timeformat="%d" ctime(_time) AS c_time
| table c_time Server UserName count
| dedup c_time Server UserName | stats count by c_time Server
... View more