How to find delta between two tables?

[damucka]

Hello,

I am trying to find the delta between two tables, but somehow failing with it. My code is as follows:

  | table host_to_report    

  |append 
  [
  |inputlookup anomalies 
  | dedup host 
  | eval hosts_with_anomalies = host 
  | table hosts_with_anomalies
  ]

Now, I would like to get the entries of the host_to_report which are NOT present in the hosts_with_anomalies.
How would I do this easiest?

Kind Regards,
Kamil

[VatsalJagani]

Hello @damucka,

Try below search:

| set diff [<your first query> | table host_to_report]  [|inputlookup anomalies | dedup host | rename host as host_to_report]

Hope this helps!!!