How to combine two searches to compare and find values present in one but not other

[atulitm]

Hello ,
I have data from 2 diff source with same fields as shown below :

index= sourcetype= source= test.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="c"

index= sourcetype= source=test1.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="z"

eval actual_pools = toString(device_name) + ";" + toString(pool_name)

I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt . tried using join and append but unable to compare .

Please help with the same , thanks.

[richgalloway]

If there are fewer than 10,000 results in test.txt then a subsearch should work. This query searches for all events in test1.txt that are not among the events in test.txt. Then the results are formatted into the 'actual_pools' field.

index=foo sourcetype=bar source=test1.txt device_name=* pool_name=* NOT [ search index=foo sourcetype=bar source=test.txt device_name=* pool_name=* ]
| eval actual_pools = device_name.";'".pool_name

[atulitm]

This doesnt work because source=test.txt has 2 more fields in logs so it will not be able to remove because logs will have few more variables hence not exact match to subtract test.txt from test1.txt .

device_name="alpha" pool_name="a" x_name="" y_name=""

[richgalloway]

So it works for the given use case, but not the real use case. Try this alternative.

index=foo sourcetype=bar source=test1.txt device_name=* pool_name=* NOT 
  [ search index=foo sourcetype=bar source=test.txt device_name=* pool_name=* 
  | fields device_name pool_name x_name y_name 
  | format  ]
| eval actual_pools = device_name.";'".pool_name

[atulitm]

I didn't understood logic behind how formatted data of source=test.txt will be removed from source=test1.txt but this doesn't work it shows exact data in source=test1.txt .

[richgalloway]

The idea is the subsearch returns a string that is appended to the main search and specifies the events that will be excluded (because of NOT) from the main search's results. Run the subsearch by itself to see what I mean. If the result of the subsearch dont' fit your data or goal then adjust it as necessary.