https://community.splunk.com/t5/Splunk-Search/Compare-IP-address-field-in-2-indexes-and-ignore-the-data-with/m-p/496223#M194637 <P>@learningnow ,</P> <P>Try</P> <PRE><CODE>(index=1 OR index=2) | stats dc(index) as count by IP_Addresses|where count &lt; 2 </CODE></PRE> Tue, 01 Oct 2019 04:46:32 GMT renjith_nair 2019-10-01T04:46:32Z https://community.splunk.com/t5/Splunk-Search/Compare-IP-address-field-in-2-indexes-and-ignore-the-data-with/m-p/496222#M194636 <P>Want to run a report by comparing 2 indexes on " IP_Addresses" field.</P> <P>Ignore any matching " IP addresses" (If IP are present in both indexes then ignore else display in query / report)<BR /> or<BR /> list any unique " IP addresses" in either index (If present in one but not in one of the other index)</P> <P>in last 7 days.</P> <P>Thanks in advance.</P> Mon, 30 Sep 2019 20:42:07 GMT https://community.splunk.com/t5/Splunk-Search/Compare-IP-address-field-in-2-indexes-and-ignore-the-data-with/m-p/496222#M194636 learningnow 2019-09-30T20:42:07Z https://community.splunk.com/t5/Splunk-Search/Compare-IP-address-field-in-2-indexes-and-ignore-the-data-with/m-p/496223#M194637 <P>@learningnow ,</P> <P>Try</P> <PRE><CODE>(index=1 OR index=2) | stats dc(index) as count by IP_Addresses|where count &lt; 2 </CODE></PRE> Tue, 01 Oct 2019 04:46:32 GMT https://community.splunk.com/t5/Splunk-Search/Compare-IP-address-field-in-2-indexes-and-ignore-the-data-with/m-p/496223#M194637 renjith_nair 2019-10-01T04:46:32Z