List of event codes that found in another search

[dyeo]

Hi, I'm trying to create a query to provide a list of event codes that are found in one period time that is NOT found in another time period. This is what I came up with, but it looks like it's just giving me the aggregate results from both searches.

index=win* EventCode=* earliest=-2d@d latest=now NOT [search index=win* EventCode=* earliest=-60d@d latest=-58d@d | stats count by EventCode] | stats count by EventCode

[richgalloway · Accepted solution]

Your query is close. Try this one:

index=win* EventCode= earliest=-2d@d latest=now NOT 
    [search index=win EventCode=* earliest=-60d@d latest=-58d@d 
    | stats count by EventCode | fields EventCode | format ] 
| stats count by EventCode

The key is the subsearch. In it's original form, it was passing counts and EventCode values to the main search. That's why your results looked the way they did. The new form will pass only EventCode values to the main search.

[dyeo]

Thanks Rich! That seems to have done it!