How to find difference between 2 search?

[yatanveersingh]

Hi All,

I am trying to search difference between 2 search:

search 1: 

index="xxx_prd" "/XX900/LT_TEST"

this is returning like 20 records.

search 2:

index="xxx_prd" "http://xxx.yyy.com/XX900/LT_TEST"

this is returning 15 records.

I want to get the 5 results which are different between search 1 and search 2.

pl advice.

Thanks

Yatan

[ITWhisperer]

index="xxx_prd" "/XX900/LT_TEST" NOT "http://xxx.yyy.com/XX900/LT_TEST"

[richgalloway · Accepted solution]

Check out the set diff command.

| set diff [ search index="xxx_prd" "/XX900/LT_TEST"]
  [ search index="xxx_prd" "http://xxx.yyy.com/XX900/LT_TEST" ]