Here is my index structure: type, from_host, to_host, times

The "type" field can be either "error" or "valid".

I would like to display distinct lines in Timelion corresponding to top 5 "from_host" keywords, and the y value should equals to the sum of "times" field of "type=valid" lines minus the sum of "times" field of "type=valid" lines for **the selected "from_host" of this split**.

I have tried this without success: `.es(split=from_host.keyword:5, metric=sum:times, q=type:valid).subtract(.es(metric=sum:times, q=type:error))`

The problem here is that the `from_host`

that is selected in the first `.es()`

query is not naturally injected in the second one, so the `sum`

is done on all `from_host`

s in the second `.es()`

query.

Is it possible to do this, and if yes, how?