Hello,
(and yes I know you can use -1 as default, but this is more fun)
As an example:
timeseries def1=count(dt.host.cpu.load,default:1),{def2=count(dt.host.cpu.load,default:0)}| fieldsadd Result = def1[] - def2[] | fieldsRemove def1,def2
Show me when I have no timeseries

or:
timeseries def1=count(dt.host.cpu.load,default:1),{def2=count(dt.host.cpu.load,default:0)}| fieldsadd Result = def2[] - def1[] +1 | fieldsRemove def1,def2
Show me when I have timeseries:

Maybe this van inspire someone
KR Henk