Show the difference between aggregated records for two filters in visualization

[jvester]

Hi,

I use a bargraph visualization to get insights in our logs. I have used a filter to find logs related to a specific event. If an error occurs we log that in a separate line and I used a different filter to find all these errors. However this means that the filter to find all logs related to the event also includes the occurrences for which later in the process an error occurred. To visualize only the successful occurrences I would need the difference between both aggregated values. Is it possible to visualize the difference in the aggregated records for both filters? I've included a screenshot of the visualization, where the red indicates the number of errors for this event and the yellow indicates the total number of occurences of this event (succesful and errors).

[Marco_Liberati]

If you want to visualize only the successful ones, you can use a formula for that.
Assuming the yellow bar is the output of a count() and the red ones from count(kql="type: error"), here's the formula to get only the successful ones:

count() - count(kql="type: error")