You should list and categorise them and then do a summarizing stats.
With a normal event search that could be done without appending but since you have the data in lookups you'd need to add a "lookup identifier field" to the lookup contents in order to avoid the append command. Assuming you don't have it, it's something like this:
| inputlookup abc.csv
| eval source=abc.csv
| table server source
| append
[ | inputlookup def.csv
| eval source=def.csv
| table server source ]
This wil, give you a set of your servers along with an identifier which lookup each server came from.
Now you can do
| stats values(source) as sources by server
And you'll get a multivalued field sources containing either of the source lookups or both of them sk you can use it to filter the data the way you want.
Alternative approach is to not add string labels but numerical ids (like 1 and 2) and then do sum() unstead of values() - then you'd have a field with value 1, 2 or 3 depending on which lookup the server was originally in.
One caveat to the initial building of the list - it uses the append command which has its limitations for run time (which will not be an issue here) and the number of returned results (which might). If you had the field I mentioned at the beginning identifying the lookup, instead of using the append command you could just use another inputlookup command with an append=t option.
