Two sets subtraction

[pitmod]

I have a two saved searches A and B. Each gives an output like below:

A:                             

host

host1

host2

host 3

B:

host

host 2

host 3

host 4

I'd like to execute search that uses results of both saved searches to perform set subtraction: A - B. So in this example I should get host1 as an result. The number of hosts for A and B can be greater than 10000 so I'd like to avoid using subsearch command as my output could be truncated.

[ITWhisperer · Accepted solution]

There are probably a number of ways to do this - try:

searchA
| eval search="A"
| append [searchB
          | eval search="B"]
| stats values(search) as search by host
| where mvcount(search)=1 AND search="A"