https://community.splunk.com/t5/Splunk-Search/Search-if-field-value-appears-in-another-search-or-not/m-p/341291#M101174 <P>This will give you the list of DeviceId values that only appear in the ActiveSync search.</P> <PRE><CODE>index=msexchange (source=otl_activesyncinventory OR source=otl_mobileiron) | stats count by source DeviceId | eventstats dc(source) as dc by DeviceId | search dc=1 source=otl_activesyncinventory | fields DeviceId </CODE></PRE> <P>You can then use that search in the first step of you first search to get the full table of results you are looking for</P> <PRE><CODE>index=msexchange source=otl_activesyncinventory [ search index=msexchange (source=otl_activesyncinventory OR source=otl_mobileiron) | stats count by source DeviceId | eventstats dc(source) as dc by DeviceId | search dc=1 source=otl_activesyncinventory | fields DeviceId ] |dedup SamAccountName, DeviceId |table companyOu, SamAccountName, "AD Account Enabled", DeviceId </CODE></PRE> Tue, 07 Mar 2017 11:21:13 GMT rjthibod 2017-03-07T11:21:13Z https://community.splunk.com/t5/Splunk-Search/Search-if-field-value-appears-in-another-search-or-not/m-p/341290#M101173 <P>Trying to find any DeviceId field values that appear in the ActiveSync search but NOT in the MobileIron search.<BR /> What is the best way to do this?</P> <P>ActiveSync search:<BR /> index=msexchange source=otl_activesyncinventory<BR /><BR /> |dedup SamAccountName, DeviceId<BR /><BR /> |table companyOu, SamAccountName, "AD Account Enabled", DeviceId</P> <P>MobileIron search:<BR /> index=msexchange source=otl_mobileiron<BR /> | table, DeviceId, MailboxId, Status</P> Tue, 07 Mar 2017 11:11:03 GMT https://community.splunk.com/t5/Splunk-Search/Search-if-field-value-appears-in-another-search-or-not/m-p/341290#M101173 smcdonald20 2017-03-07T11:11:03Z https://community.splunk.com/t5/Splunk-Search/Search-if-field-value-appears-in-another-search-or-not/m-p/341291#M101174 <P>This will give you the list of DeviceId values that only appear in the ActiveSync search.</P> <PRE><CODE>index=msexchange (source=otl_activesyncinventory OR source=otl_mobileiron) | stats count by source DeviceId | eventstats dc(source) as dc by DeviceId | search dc=1 source=otl_activesyncinventory | fields DeviceId </CODE></PRE> <P>You can then use that search in the first step of you first search to get the full table of results you are looking for</P> <PRE><CODE>index=msexchange source=otl_activesyncinventory [ search index=msexchange (source=otl_activesyncinventory OR source=otl_mobileiron) | stats count by source DeviceId | eventstats dc(source) as dc by DeviceId | search dc=1 source=otl_activesyncinventory | fields DeviceId ] |dedup SamAccountName, DeviceId |table companyOu, SamAccountName, "AD Account Enabled", DeviceId </CODE></PRE> Tue, 07 Mar 2017 11:21:13 GMT https://community.splunk.com/t5/Splunk-Search/Search-if-field-value-appears-in-another-search-or-not/m-p/341291#M101174 rjthibod 2017-03-07T11:21:13Z