I have 2 Sourcetypes A and B with 2 important Fields SSN and Number. I want to compare all of the SSN and number's from Sourcetype A to Sourcetype B I then return Results that only show up in Sourcetype B
Sourcetype A
SSN number
Sourcetype B
SSN number
I am really stuck on this one not even sure where to start.
Try like this
sourcetype=SourcetypeA OR sourcetype=sourcetypeB
| stats values(sourcetype) as sourcetypes by SSN number
| where mvcount(sourcetypes)=1 AND sourcetype="sourcetypeB"
Try like this
sourcetype=SourcetypeA OR sourcetype=sourcetypeB
| stats values(sourcetype) as sourcetypes by SSN number
| where mvcount(sourcetypes)=1 AND sourcetype="sourcetypeB"