Subsearch: How can we only see results when they are NOT found?

[mattheuslima]

I running a subsearch where i use a ID to find events from the index B in the index A.

What I want to do is: list the ID's from the index B that was not found in the index A

The subsearch structure is : search index=A search index=B |table ID's

How can I list the ID's that wasn't found?

[woodcock · Accepted solution]

Skip the subsearch and do this:

index="A" OR index="B"
| stats dc(index) AS indexCount values(index) AS index BY ID
| where index="B" AND indexCount=1

[manjunathmeti]

You need to use NOT.

index=A NOT [search index=B | table ID's]