Join DBX将两个数据库连接在一起并过滤掉结果

Join DBX将两个数据库连接在一起并过滤掉结果,join,splunk,dbx,Join,Splunk,Dbx,我可以编写如下搜索: | dbquery "DB1" "SELECT A.* AOS.* FROM Assets A JOIN AssetOSs AOS ON A.AssetOSID = AOS.AssetOSID" | append [ dbquery "DB2" "SELECT DB1A.IPAddressStr DB2M.User FROM DB1.Assets DB1A JOIN DB2.Machines DB2M ON DB1A.IPAddressStr = DB2M.IP" 上面

我可以编写如下搜索:

| dbquery "DB1" "SELECT A.* AOS.* FROM Assets A JOIN AssetOSs AOS ON A.AssetOSID = AOS.AssetOSID" | append [ dbquery "DB2" "SELECT DB1A.IPAddressStr DB2M.User FROM DB1.Assets DB1A JOIN DB2.Machines DB2M ON DB1A.IPAddressStr = DB2M.IP" 
上面的查询将DB1的结果与DB2相结合

但是,如何执行dbquery以从DB1结果中排除DB2的结果呢

例如:

DB1结果:A、B、C、D DB2结果:C,D

因为C和D是DB2结果,所以我想在DB1结果中排除它们,并在最终结果中只得到A,B


任何帮助都会很好

尝试这个未经测试的查询

| dbquery "DB1" "SELECT A.* AOS.* FROM Assets A JOIN AssetOSs AOS ON A.AssetOSID = AOS.AssetOSID" 
| search NOT [ dbquery "DB2" "SELECT DB1A.IPAddressStr DB2M.User FROM DB1.Assets DB1A JOIN DB2.Machines DB2M ON DB1A.IPAddressStr = DB2M.IP"]