How do you compare values between two fields from two separate indexes?

[gbwilson]

I'm trying to compare values between two fields from two separate indexes. I only want values returned where there is not a match to a value in the Ecom index.

I might have a table like this in the Ecom index:
small-service1
small-service2
small-service3

In my cms_application index I might have values like this:
small-service1
small-service2

I want to see small-service3 as the value returned since it IS in the Ecom index but NOT in the cms_application index. Can someone help me out? I'm only getting results that say NO MATCH and the entire column for ApplicationService is coming back blank. Thanks in advance.

(index=ecom* earliest="-60m@m" sourcetype=healthchecks)  OR (index=cms_application earliest="1" latest="now") 
 | rex mode=sed field=host "s/.us.company.com//g" | lookup hostsip hostname as host | search application=*api* | dedup microservice | fields microservice
 | streamstats count by microservice, ApplicationService
 | stats values(microservice) AS microservice, values(ApplicationService) AS ApplicationService
 | mvexpand microservice 
 | eval Status = if(match(microservice,ApplicationService), "MATCH", "NO MATCH") 
 | table microservice, ApplicationService, Status
 | where Status="NO MATCH"

[woodcock]

Try this:

(index=ecom* earliest="-60m@m" sourcetype=healthchecks) OR (index=cms_application earliest="1" latest="now")
| rex mode=sed field=host "s/.us.company.com//g"
| lookup hostsip hostname as host
| search application=*api*
| eval microservice=coalesce(microservice, ApplicationService)
| stats values(index) AS index dc(index) AS indexCount BY microservice
| search indexCount=1 AND NOT index="Ecom"

[harishalipaka]

You can use match or ==

[somesoni2]

Give this a try

(index=ecom* earliest="-60m@m" sourcetype=healthchecks) OR (index=cms_application earliest="1" latest="now") | rex mode=sed field=host "s/.us.company.com//g" | lookup hostsip hostname as host | search application=*api* 
| stats values(index) as indexes by microservice ApplicationService
| eval Status = case(mvcount(indexes)=2, "MATCH", like(indexes,"ecom%"),"NO MATCH", true(),"Service in CMS but not in ECOM") | table microservice, ApplicationService, Status | where Status="NO MATCH"