Finding ip which are not exists in second index

[binojmn]

Hi All,

I am new to Splunk and need some help.

I have 2 index, and in both index there is a field "ip", How can I find the records which are not exists in second index?

For eg:

Index A

1.1.1.2, test.com
1.2.3.4 test1.com
2.3.4.5 test2.com
3.4.5.6 test3.com

Index B

1.2.3.4 test1.com
3.4.5.6 test3.com

Final Result (Exists in Index A, not in Index B)

1.1.1.2, test.com
2.3.4.5 test2.com

Please help...

Thanks

[somesoni2]

Try this

index=indexA NOT [search index=indexB | stats count by ip | table ip]