How can I return results of a query that aren’t in the results of another query? For example, I want to return the results that are returned from the first query and are not also in the second query:
First query:
<code>customEvents
| extend Product = tostring(customDimensions.["Is Successful"])
| extend TransactionNumber = tostring(customDimensions.["Transaction Number"])
| extend StoreCode = tostring(customDimensions.["StoreCode"])
| where name contains 'Transaction Posted' and customDimensions.['Transaction Number'] != ''
| where customDimensions.["Is Successful"] == "False"
| project TransactionNumber
</code>
<code>customEvents
| extend Product = tostring(customDimensions.["Is Successful"])
| extend TransactionNumber = tostring(customDimensions.["Transaction Number"])
| extend StoreCode = tostring(customDimensions.["StoreCode"])
| where name contains 'Transaction Posted' and customDimensions.['Transaction Number'] != ''
| where customDimensions.["Is Successful"] == "False"
| project TransactionNumber
</code>
customEvents
| extend Product = tostring(customDimensions.["Is Successful"])
| extend TransactionNumber = tostring(customDimensions.["Transaction Number"])
| extend StoreCode = tostring(customDimensions.["StoreCode"])
| where name contains 'Transaction Posted' and customDimensions.['Transaction Number'] != ''
| where customDimensions.["Is Successful"] == "False"
| project TransactionNumber
e.g. if the above returned
<code>145
167
100
94
56
</code>
<code>145
167
100
94
56
</code>
145
167
100
94
56
Second query:
<code>customEvents
| extend Product = tostring(customDimensions.["Is Successful"])
| extend TransactionNumber = tostring(customDimensions.["Transaction Number"])
| extend StoreCode = tostring(customDimensions.["StoreCode"])
| where name contains 'Transaction Posted' and customDimensions.['Transaction Number'] != ''
| where customDimensions.["Is Successful"] == "True"
| project TransactionNumber
</code>
<code>customEvents
| extend Product = tostring(customDimensions.["Is Successful"])
| extend TransactionNumber = tostring(customDimensions.["Transaction Number"])
| extend StoreCode = tostring(customDimensions.["StoreCode"])
| where name contains 'Transaction Posted' and customDimensions.['Transaction Number'] != ''
| where customDimensions.["Is Successful"] == "True"
| project TransactionNumber
</code>
customEvents
| extend Product = tostring(customDimensions.["Is Successful"])
| extend TransactionNumber = tostring(customDimensions.["Transaction Number"])
| extend StoreCode = tostring(customDimensions.["StoreCode"])
| where name contains 'Transaction Posted' and customDimensions.['Transaction Number'] != ''
| where customDimensions.["Is Successful"] == "True"
| project TransactionNumber
e.g. if the above returned
<code>94
95
96
97
167
100
</code>
<code>94
95
96
97
167
100
</code>
94
95
96
97
167
100
I want the result set to be:
<code>145
56
</code>
<code>145
56
</code>
145
56