Feedback:

set

Use the set operator to generate a table from two subsearches with a set operation applied to search results.

Syntax

|set <operation> <subsearch1> <subsearch2>

<operation>

Required. Specify the operation to be applied to search results. Possible options:

  • intersect: The resulting table will contain the results that exist in both subsearches.

  • union: The resulting table will contain the results from both subsearches. The ones that exist in both subsearches will be presented only once.

  • diff: The resulting table will contain the results from both subsearches. The ones that exist in both subsearches will be excluded.
<subsearch1>

Required. Specify the first subsearch, using square brackets ( [] ).
<subsearch2>

Required. Specify the second subsearch, using square brackets ( [] ).

Usage

You can use the set operator to find differences or similarities between the result sets in a consolidated form.

Examples

Example 1: Find differences between production and staging event logs.

Copy 
|set diff [eventlog | where sourcetype = 'prod' | fields src, dest, timestamp, bytes_in] [eventlog | where sourcetype = 'staging' | fields src, dest, timestamp, bytes_in]

Example 2: Find common entries between CrowdStrike and Netscope event logs.

Copy 
|set intersect [eventlog | where sourcetype contains "crowdstrike" | fields src, dest] [eventlog | where sourcetype contains "netscope"| fields src, dest]