Find item that are not present in both set

[righettod]

Hello,

I try to find the better way in order to apply the search below:

I have 2 set of data and I want to extract the list of item that are not present in both set using and ID field to check the presence.

I have tried "subsearch" command without success.

Do you know any other methods ?

Thanks in advance ;o)

Dominique

[righettod]

Thanks you very much ;o)

[alacercogitatus]

If my answer has solved your question, please check the check mark next to it so that others will know it worked. Thanks.

[alacercogitatus · Accepted solution]

subsearch only searches the main search with the results of the subsearch. You will probably find what you are looking for in the "join" command. So try something like this:

main_search | join ID type=outer [subsearch]|stats count(host) as chost by ID|where chost < 2

This assumes that the events are on two different hosts. You can change the stats to count whatever values you need that shows a successful join.