How to achieve the result of the Datset - Minus query like

[archestain]

Query A/Dataset A

sourcetype=aws_cloudtrail eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z" | stats values(eventnames) by accesskeyid

output:

accesskeyid.  values(eventnames)

ABCD.                  ListTopic CreateTopic

EFGH.                  CreateStream

Query B/Dataset B

sourcetype=aws_cloudtrail eventtime > "2021-04-01T00:00:00Z" AND eventtime < "2021-04-28T23:59:59Z" | stats values(eventnames) by accesskeyid

output:

accesskeyid.  values(eventnames)

ABCD             ListTopic ListBuckets Createtopic

EFGH.             CreateStream DeleteStream

DEF.                ListTickets

Ask:

Please provide a query where i need the output like below where only the unique values of eventnames from datasetB group by acesskeyid should be listed out when i run both the queries at the same search

output:

accesskeyid.  values(eventnames)

ABCD             ListBuckets

EFGH.             DeleteStream

DEF.                ListTickets

Thanks inn advance

[archestain]

My bad, i mentioned the timelines wrong its the following eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-03-31T23:59:59Z"

Ran the query but it does not fetch the expected result 😞

[ITWhisperer]

I assume eventnames is already extracted as a field? Can you share some anonymised events?

[archestain]

The field is not eventnames but eventname, my bad i executed with eventnames

Thanks ITWhisperer for your help

[ITWhisperer · Accepted solution]

sourcetype=aws_cloudtrail (eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z") OR (eventtime > "2021-04-01T00:00:00Z" AND eventtime < "2021-04-28T23:59:59Z")
| eval eventnamesA=if(eventtime > "2021-01-01T00:00:00Z" AND eventtime < "2021-01-31T23:59:59Z",eventnames,null)
| eventstats values(eventnamesA) as eventnamesA by accesskeyid
| eval eventnames=if(isnull(mvfind(eventnamesA,eventnames)),eventnames,null)
| stats values(eventnames) by accesskeyid