How can I count the number of field values not present?

[crisjnelson]

I have a set of field values 101,102,103,104,105

Here are sample log events

datetime, val=101
datetime, val=105
datetime, val=103
datetime, val=101
datetime, val=103
datetime, val=105
datetime, val=101

How can I count the number of field values not present?
102 and 104are would not be found from the previous list; 2 field values not found.

[crisjnelson]

Wow, that's pretty interesting. Thanks!

[niketn · Accepted solution]

@crisjnelson, refer to answer by @somesoni2 https://answers.splunk.com/answers/612603/how-to-search-what-values-are-missing-in-my-lookup.html

Add | eval data_source="lookup" to the first search that you have to return all values i.e. 101, 102... 105. Then Add | eval data_source="index" to the second search which may or may not return all the values. Finally perform a stats to keep source as a multi-valued field to perform filter based on whether data is present or not.

Following is run any where search based on data similar to the one in the question. Please replace with your first and second search instead of | makeresult ... | mvexpand

| makeresults
| eval val="101,102,103,104,105"
| makemv val delim=","
| mvexpand val
| eval data_source="lookup"
| append [| makeresults
| eval val="101,102,101,103,102,101,101,101,102,103"
| makemv val delim=","
| mvexpand val
| eval data_source="index"]
| stats count values(data_source) as data_source by val
| search data_source="lookup" AND data_source!="index"
| stats count