anchor.diff:  
   `total`::
   (object)
  -Metadata about the number of matching events.
  +Metadata about the number of matching events or sequences.
   +
   .Properties of `total`
   [%collapsible%open]
  
positive.code: 
  `hits`::
  (object)
  Contains matching events and metadata.
  +
  .Properties of `hits`
  [%collapsible%open]
  
negative.code: 
  `value`::
  (integer)
  For <<eql-basic-syntax,basic queries>>, the total number of matching events.
  +
  For <<eql-sequences,sequence queries>>, the total number of matching sequences.
  
  `relation`::
  +
  --
  (string)
  Indicates whether the number of events or sequences returned is accurate or a
  lower bound.
  
  Returned values are:
  
  `eq`::: Accurate
  `gte`::: Lower bound, including returned events or sequences
  --
  =====
  
  