https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509384#M9100 <P>Try a subsearch</P><LI-CODE lang="markup">index=** sourcetype=** NOT [ index=test sourcetype=sample | rex "type=(?&lt;Job&gt;.*) " |dedup Job | rename Job as JOBS | fields JOBS | format ] | rename JOBS AS Job | dedup Job | table Job </LI-CODE><P>This search looks for events in index ** which are not in index test.&nbsp; I changed the field name in the subsearch to match the name used in the main search.&nbsp;</P> Wed, 15 Jul 2020 19:43:06 GMT richgalloway 2020-07-15T19:43:06Z https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509356#M9099 <P>Hi,&nbsp;<BR /><BR />how to compare search1 results with search2 and list out how many matched and not matched.<BR />EX: search1: index=test sourcetype=sample | rex "type=(?&lt;Job&gt;.*) " |dedup Job |table Job<BR />search2:&nbsp;&nbsp;index=** sourcetype=** |rename JOBS AS Job |dedup Job |table Job<BR /><BR />sample data from search1:</P><P>Jobs</P><P>xxx</P><P>yyy</P><P>zzz</P><P>aaa</P><P>sample data from search2:</P><P>Jobs</P><P>aaa</P><P>bbb</P><P>ccc</P><P>ddd</P><P>xxx</P><P>ttt<BR /><BR />Expected sample output:<BR />search1 is returning 100 jobs and search2 is returning 200 jobs, we need to list out the jobs those are not matching search1 with search2<BR />for example: out of 100 jobs if 40 matched with search2 remaining 60 not matched jobs list in search1&nbsp;</P><P>Output:</P><P>Jobs</P><P>bbb</P><P>ccc</P><P>ddd</P><P>ttt</P><P>Tried |set diff command but not worked, Please help. Thanks in advance.<BR />&nbsp; &nbsp; &nbsp; &nbsp;</P> Wed, 15 Jul 2020 17:23:38 GMT https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509356#M9099 james_n 2020-07-15T17:23:38Z https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509384#M9100 <P>Try a subsearch</P><LI-CODE lang="markup">index=** sourcetype=** NOT [ index=test sourcetype=sample | rex "type=(?&lt;Job&gt;.*) " |dedup Job | rename Job as JOBS | fields JOBS | format ] | rename JOBS AS Job | dedup Job | table Job </LI-CODE><P>This search looks for events in index ** which are not in index test.&nbsp; I changed the field name in the subsearch to match the name used in the main search.&nbsp;</P> Wed, 15 Jul 2020 19:43:06 GMT https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509384#M9100 richgalloway 2020-07-15T19:43:06Z https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509483#M9101 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;,</P><P>Thanks for the quick replay, Small mistake from my side that is required output. Please find the required output.</P><P>sample results from search1:</P><P><STRONG>Jobs</STRONG></P><P>xxx</P><P>yyy</P><P>zzz</P><P>aaa</P><P>sample data from search2:</P><P><STRONG>Jobs</STRONG></P><P>aaa</P><P>bbb</P><P>ccc</P><P>ddd</P><P>xxx</P><P>ttt<BR /><BR />Expected output:<BR /><BR /><STRONG>Jobs:<BR /></STRONG></P><P>yyy</P><P>zzz<BR /><BR /></P><P>Please help me, Thanks in advance.</P> Thu, 16 Jul 2020 09:23:50 GMT https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509483#M9101 james_n 2020-07-16T09:23:50Z https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509511#M9102 <P>That changes things a bit..</P><LI-CODE lang="markup">index=test sourcetype=sample | rex "type=(?&lt;Job&gt;.*) " | dedup Job | search NOT [ index=** sourcetype=** | rename JOBS AS Job | dedup Job | fields Job | format ] | table Job</LI-CODE><P>&nbsp;</P> Thu, 16 Jul 2020 13:21:48 GMT https://community.splunk.com/t5/Splunk-Dev/How-match-the-two-different-search-results/m-p/509511#M9102 richgalloway 2020-07-16T13:21:48Z