https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-combine-two-searches/m-p/114425#M30260 <P>I haven't written a complex splunk query for a while, please help me in getting started with this. This is what i am trying to do,</P> <P>I have a master list of hosts which i have loaded into Splunk. i want to compare that hosts with another list which i get by running a query in splunk. The outcome i am expecting is, Y if it is matching in both the list 'N' if it is there on the first list but not on the second.</P> Thu, 09 Jul 2015 11:36:24 GMT anoopambli 2015-07-09T11:36:24Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-combine-two-searches/m-p/114425#M30260 <P>I haven't written a complex splunk query for a while, please help me in getting started with this. This is what i am trying to do,</P> <P>I have a master list of hosts which i have loaded into Splunk. i want to compare that hosts with another list which i get by running a query in splunk. The outcome i am expecting is, Y if it is matching in both the list 'N' if it is there on the first list but not on the second.</P> Thu, 09 Jul 2015 11:36:24 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-combine-two-searches/m-p/114425#M30260 anoopambli 2015-07-09T11:36:24Z https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-combine-two-searches/m-p/114426#M30261 <P>Like this:</P> <PRE><CODE>&lt;first search here&gt; | dedup host | eval type=1 | append [search &lt;second search here&gt; | dedup host | eval type=2] | stats values(type) AS types dc(type) AS numTypes BY host | eval outcome=case(numTypes=2,"Y",type=1,"N",type=2, "?", 1==1,"??") |table host outcome </CODE></PRE> Thu, 09 Jul 2015 12:20:05 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-query-to-combine-two-searches/m-p/114426#M30261 woodcock 2015-07-09T12:20:05Z