https://community.splunk.com/t5/Splunk-Search/Set-operator/m-p/153502#M185622 <P>Try this</P> <P>index=mobile Action_Name=Page_View OS="*" | eval temp=if(like(app_usage_location,"%Stadium%") OR like(app_usage_location,"%Park%" OR like(app_usage_location,"%Unkno%"),1,2) | stats values(temp) as temp by user_id | where mvcount(temp)=1 | fields user_id</P> Mon, 28 Sep 2020 17:48:42 GMT somesoni2 2020-09-28T17:48:42Z https://community.splunk.com/t5/Splunk-Search/Set-operator/m-p/153501#M185621 <P>I've tried using SET operator to find all the users who satisfy first condition but are not present in second search with different condition...below is an example query..</P> <P>given set operator's limit of 10k records, I'm trying to find the best way to implement SET operations especially DIFF </P> <P>Any pointers would be great</P> <P>thanks, ronak</P> <PRE><CODE>| set diff [search index=mobile Action_Name=Page_View OS="*" (app_usage_location=*Stadium* OR app_usage_location=*Park* OR app_usage_location=*Unkno*) | fields user_id] [ search index=mobile Action_Name=Page_View OS="*" NOT(app_usage_location=*Stadium* OR app_usage_location=*Park* OR app_usage_location=*Unkno*) |fields user_id] | stats dc(user_id) </CODE></PRE> Tue, 07 Oct 2014 05:12:17 GMT https://community.splunk.com/t5/Splunk-Search/Set-operator/m-p/153501#M185621 ronak 2014-10-07T05:12:17Z https://community.splunk.com/t5/Splunk-Search/Set-operator/m-p/153502#M185622 <P>Try this</P> <P>index=mobile Action_Name=Page_View OS="*" | eval temp=if(like(app_usage_location,"%Stadium%") OR like(app_usage_location,"%Park%" OR like(app_usage_location,"%Unkno%"),1,2) | stats values(temp) as temp by user_id | where mvcount(temp)=1 | fields user_id</P> Mon, 28 Sep 2020 17:48:42 GMT https://community.splunk.com/t5/Splunk-Search/Set-operator/m-p/153502#M185622 somesoni2 2020-09-28T17:48:42Z