I have two indexes. I can join them and see the results based on a common field. I want to see only the results in the second index that are not part of the first index.
index=BASE earliest=0
| eval LPR = strptime(LastPolicyRequest, "%m/%d/%Y %I:%M:%S %p")
| where LPR >= relative_time(now(),"-7d@h")
| table "WiFiMAC","LastPolicyRequest","ValidFrom","ValidTo"
| join type=left WiFiMAC
[ search BASE earliest =-48h
| eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S")
| eval Indextime =strptime(indextime,"%Y-%m-%d %H:%M:%S.%N")
| eval Time =strptime(_time,"%s")
| eval Minutes_Diff = round((Indextime - Time)/60,2)
| stats avg(Minutes_Diff) as Avg_Minutes_Diff stdev(Minutes_Diff) as StDev_Minutes_Diff min(Minutes_Diff) as Min_Minutes_Diff max(Minutes_Diff) as Max_Minutes_Diff count as count by WiFiMAC
| eval Avg_Minutes_Diff = round(Avg_Minutes_Diff,2)
| rename count as "Sample Size"
| table "WiFiMAC", "Avg_Minutes_Diff", "StDev_Minutes_Diff", "Min_Minutes_Diff", "Max_Minutes_Diff", "Sample Size" ]
| table "WiFiMAC", "Avg_Minutes_Diff", "StDev_Minutes_Diff", "Min_Minutes_Diff", "Max_Minutes_Diff","ValidFrom","ValidTo","LastPolicyRequest", "Sample Size"
| dedup WiFiMAC
Any Ideas?
Hey
Let's say you WiFiMAC is the field that you use to eliminate them, you can use a strategy like the following:
Index 2 NOT [ search index 1 | ..... | return WiFiMAC]
That will show you index 2 entries that don't have any value of the index 1 entries you got in that subsearch
Hey
Let's say you WiFiMAC is the field that you use to eliminate them, you can use a strategy like the following:
Index 2 NOT [ search index 1 | ..... | return WiFiMAC]
That will show you index 2 entries that don't have any value of the index 1 entries you got in that subsearch
... that did it. Thank you!