I've been trying to solve this problem for days now with no success. Maybe I can find ultimate salvation here.  I have a single index where I need to run 2 queries.  First query finds all hosts that generate logs for a particular app called APP.  I need to count totals. Second query searches for a hosts that were scanned by the APP. Problem: I need to deduct hosts detected in Query 2 from hosts found in Query 1. That will generate a list of hosts that were potentially not scanned in a selected period of time. Query 1: index=demon source="/opt/app/logs/*" Query 2: index=demon source="*scan.log" "scan Finished" From what I learnt so far |multisearch appears to be the best candidate however when I run the below query I only get 1 variable listed, I guess because of host that can be attributed only once.   I'm sure there are multiple ways of achieving this goal.   Thanks   ... View more