How to find the difference in field values between two lookups

[Jasper]

Hello all,

I had a question that I have been trying to figure out how to address within a concise SPL query. 

I have two lookups with a field name of X, lookup1 and lookup2 have all these values populated and I am trying to find a query to output the difference in field values for X between the two lookups. 

lookup1's X value has a Multi-value field, where as lookup2 is only single values.

E.g.

Lookup1 has field values:

Banana

Apple

Oranges

Lookup2 has field values:

Banana

Expected output from desired query:

Apple

Oranges

Is there a way to do this between these two lookups with the above in mind? This seems feasible with one lookup, but comparing two lookups has proven to be difficult. Any support would be appreciated!

[ITWhisperer]

| inputlookup lookup1
| append [| inputlookup lookup2]
| stats count by field
| where count = 1

[Jasper]

Thanks for the reply, I could see this working out however I used an alternative approach I would like to share that worked for my purposes. This syntax issue initially was causing some frustration.

| from inputlookup:1 | search NOT [ | inputlookup2 ]

This logic I believe works only if the first field names are in alignment, can append a pipe and field after inputlookup2 to help this logic work out. This was the most concise query I could find.