Hi community,  I have 2 different lists with fields as follow : list A - ip_address, source, account_id list B - ip_address, source, account_id, field4, field5 I want to compare both lists to accomplish list(B) - list(A), ie. remain only list(B) entries with unique ip_address value, comparing to list(A) entries, while also return the field value of field4 and field5.  Example  list A ip_address source account_id 10.0.0.1 A 1000 192.168.0.1 A 1001   list B  ip_address source account_id field4 field5 10.0.0.2 B 999 xxx yyyy  192.168.0.1 B 1001 xxy yyyx   Result ip_address source account_id field4 field5 10.0.0.2 B 999 xxx yyyy    I have tried the following : index=seceng source="listB" | eval source="B" | fields ip_address source account_id field4 field5 | append [ | inputlookup listA   | eval source="A"   | fields ip_address source account_id] | stats values(source) as source, count by ip_address account_id field4 field5 | where count == 1 AND source == "B" The issue of this query is that since field4 and field5 are unique attributes for list(B) only, thus the stats query will only return list(B) entries. It works when the field4 and field5 removed from the stats query, but they are the attributes that I want to include to the result. Can anyone give me suggestion of how the expected result can be accomplished ? Really appreciate that, and thanks in advance ! ... View more