https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89135#M182220 <P>Sadly there is not... but a new machine is already ordered. (12 CPU cores plus Hyperthreading instead of 2 cores witouht Hyperthreading and 96GB instead of 2GB RAM, that should work! xD)</P> Mon, 10 Oct 2011 14:41:16 GMT Katsche 2011-10-10T14:41:16Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89129#M182214 <P>Hi all,</P> <P>I have two searches here, which are nearly the same (5 Events more at one of them).<BR /> Is it somehow possible to Subtract the 289 events of the first search from the 294 other events of the second search?</P> <P>Kind regards,<BR /> Katsche</P> Mon, 10 Oct 2011 12:22:12 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89129#M182214 Katsche 2011-10-10T12:22:12Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89130#M182215 <P>I'd like to now the 5 events which are more.</P> Mon, 10 Oct 2011 12:35:39 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89130#M182215 Katsche 2011-10-10T12:35:39Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89131#M182216 <P>Can the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Set">set command</A> help you?</P> Mon, 10 Oct 2011 12:38:27 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89131#M182216 Paolo_Prigione 2011-10-10T12:38:27Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89132#M182217 <P>Just checked the Search Reference Manual. Looks very promising. Let me run my search and I will get back to you. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 10 Oct 2011 12:45:15 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89132#M182217 Katsche 2011-10-10T12:45:15Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89133#M182218 <P>Ok, this is the answer, but I will have to figure out something else, because there is not enough RAM on my machine to run such a strong search...</P> Mon, 10 Oct 2011 13:26:44 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89133#M182218 Katsche 2011-10-10T13:26:44Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89134#M182219 <P>ouch... I think Splunk doesn't provide a "| addRAM" command OOTB... <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 10 Oct 2011 13:54:38 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89134#M182219 Paolo_Prigione 2011-10-10T13:54:38Z https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89135#M182220 <P>Sadly there is not... but a new machine is already ordered. (12 CPU cores plus Hyperthreading instead of 2 cores witouht Hyperthreading and 96GB instead of 2GB RAM, that should work! xD)</P> Mon, 10 Oct 2011 14:41:16 GMT https://community.splunk.com/t5/Splunk-Search/Subtract-events-of-two-searches/m-p/89135#M182220 Katsche 2011-10-10T14:41:16Z