Comparing two search results and listing unique ones as table

[renjithk]

Hi,

Have logs for both request to a server and its response. However, in some cases the response won't be received and want to get those missed records only to a new table. User id is the common functionality appearing in both logs.

index=mtest ("X-Responding-Instance:ms*" OR "HTTP request to ms is registered successfully") | rex field=_raw ".*X-userid: (?<Success_UserId>.*)" | table Success_UserId usrId

X-userid is coming as a header in response and I have to extract value from there. 'usrId' is already coming along with the 'registered successfully' message as a field and I can extract it without rex.

The moment I add '| tableSuccess_UserId usrId' to above query, gets two table with values, but the records are coming in alternate lines and that maybe the reason I'm not able to compare between them.

Is there any option to compare between the data in two tables and find out the records of usrId, that are missing in Success_UserId table?

[richgalloway]

The user id values are on different lines because they are in different events.  They can be merged using coalesce and stats.

index=mtest ("X-Responding-Instance:ms*" OR "HTTP request to ms is registered successfully") 
| rex field=_raw ".*X-userid: (?<Success_UserId>.*)" 
| eval userId = coalesce(usrId, Success_UserId)
| stats values(*) as * by usrId
| table Success_UserId usrId