I have a two saved searches A and B. Each gives an output like below:
A:
host
host1
host2
host 3
B:
host
host 2
host 3
host 4
I'd like to execute search that uses results of both saved searches to perform set subtraction: A - B. So in this example I should get host1 as an result. The number of hosts for A and B can be greater than 10000 so I'd like to avoid using subsearch command as my output could be truncated.
There are probably a number of ways to do this - try:
searchA
| eval search="A"
| append [searchB
| eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"
There are probably a number of ways to do this - try:
searchA
| eval search="A"
| append [searchB
| eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"