I am using two searches
Search1 search 2
1 1
2 2
3 3
5 4
Using set diff gives me the result. I don't want to use join.
set diff [search index=ABC sourcetype=PQRS| stats count by x_orderno | fields - count]
[search index=DEF sourcetype=WXYZ| stats count by x_orderno | fields - count]
x_orderno
5
4
I want the result as
x_orderno sourcetype
5 PQRS
4 WXYZ
Kindly suggest.
TIA
Like this:
| makeresults
| eval raw="sourcetype=PQRS,x_orderno=1 sourcetype=WXYZ,x_orderno=1 sourcetype=PQRS,x_orderno=2 sourcetype=WXYZ,x_orderno=2 sourcetype=PQRS,x_orderno=3 sourcetype=WXYZ,x_orderno=3 sourcetype=PQRS,x_orderno=5 sourcetype=WXYZ,x_orderno=4"
| makemv raw
| mvexpand raw
| rename raw AS _raw
| kv
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| stats dc(sourcetype) AS sourcetypeCount values(sourcetype) AS sourcetype BY x_orderno
| where sourcetypeCount==1
| table x_orderno sourcetype
Like this:
| makeresults
| eval raw="sourcetype=PQRS,x_orderno=1 sourcetype=WXYZ,x_orderno=1 sourcetype=PQRS,x_orderno=2 sourcetype=WXYZ,x_orderno=2 sourcetype=PQRS,x_orderno=3 sourcetype=WXYZ,x_orderno=3 sourcetype=PQRS,x_orderno=5 sourcetype=WXYZ,x_orderno=4"
| makemv raw
| mvexpand raw
| rename raw AS _raw
| kv
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| stats dc(sourcetype) AS sourcetypeCount values(sourcetype) AS sourcetype BY x_orderno
| where sourcetypeCount==1
| table x_orderno sourcetype
Awesome. Thanks 🙂
Try like this
(index=ABC sourcetype=PQRS) OR (index=DEF sourcetype=WXYZ)
| stats values(sourcetype) as sourcetype by x_orderno
| where mvcount(sourcetype)=1