topic Re: How to find difference between 2 search in Reporting

How to find difference between 2 search?

yatanveersingh — Tue, 30 Aug 2022 22:54:24 GMT

Hi All,

I am trying to search difference between 2 search:

search 1:

index="xxx_prd" "/XX900/LT_TEST"

this is returning like 20 records.

search 2:

this is returning 15 records.

I want to get the 5 results which are different between search 1 and search 2.

pl advice.

Thanks

Yatan

richgalloway — Tue, 30 Aug 2022 21:03:00 GMT

Check out the set diff command.

| set diff [ search index="xxx_prd" "/XX900/LT_TEST"] [ search index="xxx_prd" "http://xxx.yyy.com/XX900/LT_TEST" ]

ITWhisperer — Tue, 30 Aug 2022 21:13:43 GMT

index="xxx_prd" "/XX900/LT_TEST" NOT "http://xxx.yyy.com/XX900/LT_TEST"