anchor.diff:  
   `value`::
   (integer)
  -Total number of matching events.
  +For <<eql-basic-syntax,basic queries>>, the total number of matching events.
  ++
  +For <<eql-sequences,sequence queries>>, the total number of matching sequences.
   
   `relation`::
   +
   --
   (string)
  -Indicates whether the number of events returned is accurate or a lower bound.
  +Indicates whether the number of events or sequences returned is accurate or a
  +lower bound.
   
   Returned values are:
   
   `eq`::: Accurate
  -`gte`::: Lower bound, including returned events
  +`gte`::: Lower bound, including returned events or sequences
   --
   =====
   
  
positive.code: 
  `total`::
  (object)
  Metadata about the number of matching events.
  +
  .Properties of `total`
  [%collapsible%open]
  
negative.code: 
  `hits`::
  (object)
  Contains matching events and sequences. Also contains related metadata.
  +
  .Properties of `hits`
  [%collapsible%open]
  