How to find host diff from two searches in the same index?

[rest_assured]

I've been trying to solve this problem for days now with no success. Maybe I can find ultimate salvation here. 

I have a single index where I need to run 2 queries. 

First query finds all hosts that generate logs for a particular app called APP.  I need to count totals.

Second query searches for a hosts that were scanned by the APP.

Problem: I need to deduct hosts detected in Query 2 from hosts found in Query 1. That will generate a list of hosts that were potentially not scanned in a selected period of time.

Query 1:

index=demon source="/opt/app/logs/*"

Query 2:

index=demon source="*scan.log" "scan Finished"

From what I learnt so far |multisearch appears to be the best candidate however when I run the below query I only get 1 variable listed, I guess because of host that can be attributed only once.

I'm sure there are multiple ways of achieving this goal.

Thanks

[PickleRick]

A rule of thumb says if you can use one search, don't use two. Also don't use subsearches unless you absolutely have to.

Question is whether you want to find events which match one of your searches but don't match the other or hosts listed in one search but bot the other.

[rest_assured]

I'm looking for hosts list generated by query 1 minus hosts list generated by query 2. I must find unique hosts in both and then use simple math to calculate a diff. If possible list hosts as table. 

[PickleRick]

The typical approach would be to generate list of events, classify them and find only those matching.

You can do that with two separate searches

index=demon source="/opt/app/logs/*"
| eval find_id=1
| appendpipe [
     search index=demon source="*scan.log" "scan Finished"
     | eval find_id=2 ]
| stats values(host) as host by find_id
| mvexpand host
| stats sum(find_id) as find by host
| where find=1

Depending on whether you want only those appearing in first, second or both searches, you set the last where condition to 1, 2 or 3.

You can also do this in one search with using compound OR-ed search and conditional eval but it's more complicated.

[ITWhisperer]

Try something like this

index=demon source="/opt/app/logs/*" NOT [| search index=demon source="*scan.log" "scan Finished"
| dedup host
| fields host]