I have events that are emitted by many parters to 4 different servers
My goal is to find events for each partner that are received on two servers but NEVER on the others (and vice versa).
Actually, I'm doing a search for events that match with server1 or server2. Then, I do another search for events that match with server3 or server4. And finally I export everything in a CSV and I am doing the list of partners that are only present on one of the groups
What I am trying to obtain is like an SQL "Full Join without intersection"
My actual search is like :
index="XXX" Direction=I Gateway=server1 or server2| stats count by Partner
Is it possible to obtain what I need in an only search ?