I have 2 queries producing some results
Query1: index=foo* sourcetype="abc_uvw" activity="POST*/test1" source="/logs/mylogs.log" | table mr_id
Query2: index=foo* sourcetype="abc_uvw" DOMAIN="rkps" src="pqr" source="/logs/mylogs.log"
|dedup mr_id src | table mr_id
Query1 producing 1000 results, and query2 producing 999 records. Want to know that missed mr_id among them