topic Re: Subtract results of subquery from main query in All Apps and Add-ons

Subtract results of subquery from main query

raghu0463 — Thu, 30 Jan 2020 19:13:22 GMT

Hi Wanted to subract the subquery results from main query. i.e

index=main source=/folder/abc.csv  |table customername - [index=main source=/folder/xxx.csv |table name ]

can this be achievable ? i want to get only the names which are not common from both the files.

Thanks

Re: Subtract results of subquery from main query

skoelpin — Thu, 30 Jan 2020 19:21:36 GMT

You gotta do it outside of the subsearch like such.

search abc.csv |table name  [search xxx.csv |table name ]
| eval new_field=name_one-name_two

Re: Subtract results of subquery from main query

raghu0463 — Thu, 30 Jan 2020 19:33:07 GMT

I apologize, there's small change in my question

Re: Subtract results of subquery from main query

raghu0463 — Thu, 30 Jan 2020 19:54:22 GMT

hi skoelpin,
im getting the below error

" 'table' command: Invalid argument: 'name=swbsubwg361'"

Re: Subtract results of subquery from main query

to4kawa — Thu, 30 Jan 2020 21:59:59 GMT

index=main source=/folder/abc.csv OR source=/folder/xxx.csv
| eval name=coalesce(name,customername)  
| eventstats dc(source) as flag by name
| where flag=1 AND source="/folder/abc.csv"
| table name

Hi, how about this?