We want to compare 2 inputlookup files. Lets say we have fields in lookup 1-
host- abc, bcd, def, xyz,
& lookup 2
host- bcd, xyz
required result = abc, def
simply we want to show the count of the host missing in lookup 1 when compared to lookup 2.
we have already tried
| inputlookup lookup2 |join type=left host [inputlookup lookup1 |eval check="match" ] |search NOT check=*
| inputlookup lookup2
| eval lookup="lookup2"
| append [| inputlookup lookup1 ]
| stats count values(lookup) as lookup by host
| where count=1 AND lookup="lookup2"
| stats count
Thanks for the effort, but it not giving the correct result
In what way is it wrong?
I am getting host on both the lookup files from this search. And we want only missing host from lookup1when it is compared with 2nd lookup
The hosts have to match completely - do you perhaps have some trailing or leading spaces for example which are in one lookup but not in the other?
yes they are matching completely.