I want to add three fields insert ,update and error then subtract it from count_carmen and add new row .
You could add this line if you want the total
| eval total=inserts+updates+errors
| addcoltotals count_carmen inserts updates errors
| eval count_carmen=if(isnull(_time),count_carmen-inserts-updates-errors,count_carmen)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)
It is giving me a new column and row what if I only wants a column of field name difference.
You literally said "add new row"!
If you just want the difference, try this
| eval difference=count_carmen-inserts-updates-errors
It is giving a wrong count. I want to add the insert+update+error. Then subtract it from count_carmen.
You could add this line if you want the total
| eval total=inserts+updates+errors
Remove these lines (they were only required when you had the extra row (that you originally asked for)
| eval inserts=if(isnull(_time),null(),inserts)
| eval updates=if(isnull(_time),null(),updates)
| eval errors=if(isnull(_time),null(),errors)