I would like to construct a query by comparing 2 fields (hash values) in 2 different indexes.(A&B).........
If Hash Value in Index A matches Hash value in Index B then ignore those results else return results if hashes not matching
@ITWhisperer I have updated my question.....I have removed my example for better understanding. Let me know if that is clear . TIA
index="A" OR index="B"
| eventstats count by hash
| where count < 2
index=A OR index=B
| stats dc(index) as indexes by hostname
| where indexes < 2