Splunk App for Unix and Linux: How can compare the 2 servers and get the unique ones from list one?

[pradipto]

I have two lists of servers from two queries:

Search 1 ==>

| metadata type=hosts index=os| search host=srt* OR host=c1a* OR host=c2a*|table host|rename host as HostNames

Search 2 ==>

index="os" sourcetype="ps" host=srt* OR host=c1a* OR host=c2a* | eval processexists=if(match(_raw, "puppet"), 1, 0)  | search processexists=1 |dedup host|table host|rename host as PuppetClients

Now I want to find the servers that are there in Search 1 and not in Search 2.

[493669 · Accepted solution]

try this:

| metadata type=hosts index=os| search host=srt* OR host=c1a* OR host=c2a*|table host| search NOT[search index="os" sourcetype="ps" host=srt* OR host=c1a* OR host=c2a* | eval processexists=if(match(_raw, "puppet"), 1, 0) | search processexists=1 |dedup host|table host]

[pradipto]

Works fine

[493669]

glad to help:) please upvote as well

[493669]

have you tried it?