simple questions about a search

[nebel]

hi there,

with the search...

`all_forwarders` | fields sourceHost 

...I will get all forwarder host names.
On the other hand I have a csv file which includes all servers. Now I want to create a diff between the csv file and the 'all forwarders' search.

At the moment I am using the following search to built a diff

inputlookup all_servers | search NOT [search `all_forwarders` | fields sourceHost]

The search is very not very efficient I think. Sometimes it gets totaly wrong results, sometimes it works fine...There a more than 8000 servers in the list...

Could you please help me to find more efficient search string?

Thank you very much in advance!

Regards

[lguinn2 · Accepted solution]

Well, one problem is that your subsearch will return only 100 events; this is probably why you are not getting consistent results. I would do it this way

| inputlookup all_servers 
| fields sourceHost
| eval match_found=0
| join type=outer sourceHost
  [ search `all_forwarders`
    | eval match_found=1
    | fields sourceHost match_found 
    | format maxresults = 10000 ]
| where match_found = 0

I am not sure that this is more efficient, but it should at least be right.