Return results that are in Index1 and NOT in Index2

[tristanmatthews]

I have two indexes one contains objects of interest and things I don't care about, all_results, and the other is a list of things I know I don't care about, bad_results, I want to return elements of the first list that don't exist in the second. I was able to make it working by using.

Is there a simpler / better way to do this then something like:

index=all_results OR index=bad_results | eval isBad=if(index="bad_results", key, 0) | where key!=isBad | transaction key maxspan=1d maxevents=-1

Thanks

[gkanapathy · Accepted solution]

index=all_results NOT [ search index=bad_results | return 10000 key ] 

if you have 10000 or fewer distinct keys in bad_results or:

index=all_results OR index=bad_results | stats count(eval(index=="bad_results")) as b by key | where b<1 

doesn't appear simpler than yours, but it runs better if you have a multi-node Splunk system. on the other hand, it doesn't return the whole item, just the key, though you can fix that by adding first(otherfield) as otherfield to the stats command.