Hi Experts,
I wondered the best way of comparing the below data. So I have a query which returns as so .
index=myindex sourcetype=mysourcetype host="myhost" |table process, tier, country
This returns a 100 or so processes their tier and country as expected. There is only 4 countries uk, usa, denmark and spain
It returns something like this
process tier country
process1 roman uk
process2 roman usa
Process3 roman Denmark
process4 anglo uk
process5 anglo usa
process6 anglo Denmark
process7 anglo spain
The roman tier should be present in each country . If Spain is missing as above how to I only show the missing entry for spain as the outlier ? This is basically for a rec purpose so we can see whats missing.
thanks in advance !
