Compare IP_address field in 2 indexes and ignore the data with the same values / or matches and display the rest.

[learningnow]

Want to run a report by comparing 2 indexes on " IP_Addresses" field.

Ignore any matching " IP addresses" (If IP are present in both indexes then ignore else display in query / report)
or
list any unique " IP addresses" in either index (If present in one but not in one of the other index)

in last 7 days.

Thanks in advance.

[renjith_nair · Accepted solution]

@learningnow ,

Try

(index=1 OR index=2) | stats dc(index) as count by IP_Addresses|where count < 2