I have two query i want to get those result that are in query 1 but not in query 2 Query 1 : index=APP_SERVER- source=API_LOG "Error while create record for customer id*" |rex "customer id : (?<custId>.*\w+)" |dedup custId |table custId Output : 94ABGH0048 902SDKK557 902SGHT224 902SLWT720 Query 2 : index=APP_SERVER- source=API_LOGS "Successfully created record for customer id*" |rex "customer id : (?<custId>.*\w+)" |dedup custId |table custId Output : 945TTFK0548 94ABGH0048 902SLWT720 I want below output out of both query ,it means these id are in query 1 result but not in query 2 result 902SDKK557 902SGHT224
... View more