Find a host that is reporting to one index, but not another.

[lhanich1]

I am attempting the following:

Find hosts that are logging to one index but not the other by the host field.

Use case, find hosts reporting via AWS API but are not logging host logs via OS UF.

I have tried a left join but my results are not consistent and have spent countless time trying to come to a solution.

Thanks in advance.

[somesoni2]

Try like this (assuming you don't need any other filter than on 'index' field to select your data

| tstats count WHERE index="AWS API index name here" OR index="OS UF index name here" by host index
| stats values(index) as indexes by host
| where mvcount(indexes)=1  AND index="AWS API index name here" 

[lhanich1]

this actually doesnt return any results for some reason, i do have other fields i am filtering on.... but i did try the query as suggested to see the outcome but no results

[somesoni2]

What's the query you tried? Also could you share your full query with additional filters? (mast anything sensitive)

[pkeenan87]

I am going to assume that every host that reports into the aws index should also report into the os index. Something like this could work for you

index=index_one OR index=index_two | stats dc(index) as indexes_reporting values(index) as index_names by host | where indexes_reporting=1

This should return the hosts that are only reporting into one of the two indexes. The index that they are reporting into will be in the index_names field.