How do you do disjunction of two sets in join condition

[arungeorge09]

I have a common field and 2 joins and want to work on the data which does not fall in the join condition.

[somesoni2]

Have a look at Splunk's "set" command with diff option.
http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/Set

An example syntax would be

| set diff [Your first search  | table commonField] [Your second search  | table commonField] 

[arungeorge09]

Can someone please answer . I am looking for a minus query.

[arungeorge09]

I have 2 searches with a join condition txId . But I know that the second subsearch does not have same items. I want it as raw events. I tried the following

index=xyz event="NEAT-IN" platform=apns | eval txId=alertId |join txId [search index=xyz event=pushApns] | where isnull(txId)

Why this does not work. I got 0 events. This is not correct. There are less events in second subsearch based on stats.

I have a dashboard to prepare and really appreciate the help.

[somesoni2]

By default, output of the join command is "inner join" and thus its just returning (if any) matching rows. So you'll not get any events with the isnull filter.

Try this to get all the non-matching rows from First search.

index=xyz event="NEAT-IN" platform=apns | eval txId=alertId |join type=left txId [search index=xyz event=pushApns] | where isnull(txId)

[arungeorge09]

@somesoni2 . The query works but it gives me zero results.
I have 578 distinct count(alertId) in first search
I have 488 distinct count(txId) in second search

I still don't understand why I will get 0 results.

Note: It should be isnull(alertId) because alertId is on the right table.