I running a subsearch where i use a ID to find events from the index B in the index A.
What I want to do is: list the ID's from the index B that was not found in the index A
The subsearch structure is : search index=A search index=B |table ID's
How can I list the ID's that wasn't found?
You need to use NOT.
index=A NOT [search index=B | table ID's]
Skip the subsearch and do this:
index="A" OR index="B"
| stats dc(index) AS indexCount values(index) AS index BY ID
| where index="B" AND indexCount=1
View solution in original post