Listing the common fields from 2 Indexes that that dont exist during a specified time

[Ansab]

I am trying to correlate authentication attempts [ index_A (username, role) vs index_B (username, authentication_time) ]

I want users returned from index_A who dont show up in index_B over last certain number of days (ex. 14 days)

To word it better, unique fields from index_A (which live in index_A) which can show up in index_B but I want to list the ones that dont show up 

My current solutions is piping a search between the 2 indexes over a "username" field but that lists all the matching items and not unique items from index_A which are not in index_B 

[bowesmana]

What is your timeframe for searching index A?

A simple example would be

index=A OR index=B
| stats values(index) as indexes values(authentication_time) as authentication_time values(role) as rol by username
| where mvcount(indexes)=1 AND indexes="A"

which will search both A and B and then collect the fields you want (role, authentication_time) and also index. It then counts the number of types of index and will only report those that have index A

You could also change the time range for the searches for index A and B by adding brackets and earliest/latest filter criteria to the search, e.g.

(index=A earliest=@d latest=now) OR (index=B earliest=-2w latest=now)
...

which will look in index A for today and index B for the last two weeks.

This fits the first part of your question, but when you mention unique fields in index A that does not address that - is that something extra you want?