Splunk Search
Highlighted

Find the missed id in the Query2 compared with Query1

Explorer

I have 2 queries producing some results

Query1: index=foo* sourcetype="abcuvw" activity="POST*/test1" source="/logs/mylogs.log" | table mrid

Query2: index=foo* sourcetype="abcuvw" DOMAIN="rkps" src="pqr" source="/logs/mylogs.log"
|dedup mr
id src | table mr_id

Query1 producing 1000 results, and query2 producing 999 records. Want to know that missed mr_id among them

0 Karma