I have two lists of servers from two queries:
Search 1 ==>
| metadata type=hosts index=os| search host=srt* OR host=c1a* OR host=c2a*|table host|rename host as HostNames
Search 2 ==>
index="os" sourcetype="ps" host=srt* OR host=c1a* OR host=c2a* | eval processexists=if(match(_raw, "puppet"), 1, 0) | search processexists=1 |dedup host|table host|rename host as PuppetClients
Now I want to find the servers that are there in Search 1 and not in Search 2.
try this:
| metadata type=hosts index=os| search host=srt* OR host=c1a* OR host=c2a*|table host| search NOT[search index="os" sourcetype="ps" host=srt* OR host=c1a* OR host=c2a* | eval processexists=if(match(_raw, "puppet"), 1, 0) | search processexists=1 |dedup host|table host]
try this:
| metadata type=hosts index=os| search host=srt* OR host=c1a* OR host=c2a*|table host| search NOT[search index="os" sourcetype="ps" host=srt* OR host=c1a* OR host=c2a* | eval processexists=if(match(_raw, "puppet"), 1, 0) | search processexists=1 |dedup host|table host]
Works fine
glad to help:) please upvote as well
have you tried it?