Compare a search with two sources

[anmar02930]

I have a search that has "index=A", "Source=A", "Source=B" and both sources have the column "Address"

I want to compare what is in source A but not in Source B based on the Values "Address" 

[yuanliu · Accepted solution]

You need to define "compare".  If all that interest you is which addresses are different, it could be as simple as

index=A source IN (A,B) ``` both have common field address ```
| stats values(source) as source by address ``` source is now multivalued ```
| where source == "A" AND source != "B" ``` SPL allows multivalued equality test ```

Hope this helps.