how to get the list of hostname in one index that are not in another index in splunk

[harishsplunk7]

We want all the hosts in index=aws that are NOT in index=windows. 

Example : 

| tstats count where index=aws by host | table host
| search NOT [| tstats count where index=windows by host | table host]

[gcusello]

Hi, please try this:

| tstats 
   dc(index) AS index_count 
   WHERE index IN (aws,windows) 
   BY host
| where index_count=2
| table host

Ciao.

Giuseppe

[burwell]

Hi. Your search is so close to what I do.. change search -> where

| tstats count where index=aws by host | table host
| where NOT [| tstats count where index=windows by host | table host]