First, unless you have prior knowledge that number of Hostname in index A is always larger than that in index B in any search period, "missing" simply means that the name appears only in one index. ...
See more...
First, unless you have prior knowledge that number of Hostname in index A is always larger than that in index B in any search period, "missing" simply means that the name appears only in one index. The following does not try to address this problem, but will give you what you want, and is much simpler, perhaps more performant. (index=A sourcetype="Any") OR (index=B sourcetype="foo")
| eval Hostname=coalesce(lower(Hostname), lower(Reporting_Host))
| fields index Hostname operating_system device_type
| stats values(*) as * by Hostname
| eval match=if(mvcount(index) == 1, "missing", "ok") Not only operating system and device type, you can add any other fields of interest that may only exist in one of indices.