help for displaying events that have collected in one index but never in other

[jip31]

hi
I tried to find host from my csv file which have connected in one specific index but never in others
I have done the search below but its what i need because it just exclude events from others indexes
how to do this please??

 index="tutu*" 
| search NOT (index="toto*" OR index="tata*" OR index="titi*") 
    [| inputlookup host.csv 
    | table host] 
| dedup host 
| table host

[gcusello · Accepted solution]

Hi jip31,
try something like this:

(index="tutu*" OR index="toto*" OR index="tata*" OR index="titi*") [| inputlookup host.csv | table host] 
| stats values(index) AS index count BY host
| eval check=if(index="tutu*","only toto","also others")
| search check="only toto"
| table host

Ciao.
Giuseppe

[jip31]

perfect thanks