Hello,
I try to find the better way in order to apply the search below:
I have 2 set of data and I want to extract the list of item that are not present in both set using and ID field to check the presence.
I have tried "subsearch" command without success.
Do you know any other methods ?
Thanks in advance ;o)
Dominique
subsearch only searches the main search with the results of the subsearch. You will probably find what you are looking for in the "join" command. So try something like this:
main_search | join ID type=outer [subsearch]|stats count(host) as chost by ID|where chost < 2
This assumes that the events are on two different hosts. You can change the stats to count whatever values you need that shows a successful join.
Thanks you very much ;o)
If my answer has solved your question, please check the check mark next to it so that others will know it worked. Thanks.
subsearch only searches the main search with the results of the subsearch. You will probably find what you are looking for in the "join" command. So try something like this:
main_search | join ID type=outer [subsearch]|stats count(host) as chost by ID|where chost < 2
This assumes that the events are on two different hosts. You can change the stats to count whatever values you need that shows a successful join.