https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463366#M10785 <P>My query1 returns stats list and query2 is a subsearch that's retun another stats list. i added it with appendcols. <BR /> I want to have another 2 columns, col3:not in col1 but in col2, col4:not in col2 but in col1. <BR /> all columns are strings or alphanumeric.</P> <P>| rest /services/admin/LDAP-groups splunk_server=abc<BR /> | mvexpand roles<BR /> | search roles=admin_user<BR /> | stats values(roles) as roles list(users) as admin_users1<BR /> | appendcols<BR /> [| rest /services/admin/LDAP-groups splunk_server=xyz<BR /> | mvexpand roles<BR /> | search roles=admin_user<BR /> | stats list(users) as admin_users2]</P> <P>Result i looking(last 2 columns is what i am looking) </P> <P>admin_users1 admin_users2 admin(users1-users2) admin(users2-users1)<BR /> A |A |B |C<BR /> B |C |D |F<BR /> D |E<BR /> E |F </P> Wed, 30 Sep 2020 01:55:27 GMT shihabno 2020-09-30T01:55:27Z https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463366#M10785 <P>My query1 returns stats list and query2 is a subsearch that's retun another stats list. i added it with appendcols. <BR /> I want to have another 2 columns, col3:not in col1 but in col2, col4:not in col2 but in col1. <BR /> all columns are strings or alphanumeric.</P> <P>| rest /services/admin/LDAP-groups splunk_server=abc<BR /> | mvexpand roles<BR /> | search roles=admin_user<BR /> | stats values(roles) as roles list(users) as admin_users1<BR /> | appendcols<BR /> [| rest /services/admin/LDAP-groups splunk_server=xyz<BR /> | mvexpand roles<BR /> | search roles=admin_user<BR /> | stats list(users) as admin_users2]</P> <P>Result i looking(last 2 columns is what i am looking) </P> <P>admin_users1 admin_users2 admin(users1-users2) admin(users2-users1)<BR /> A |A |B |C<BR /> B |C |D |F<BR /> D |E<BR /> E |F </P> Wed, 30 Sep 2020 01:55:27 GMT https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463366#M10785 shihabno 2020-09-30T01:55:27Z https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463367#M10786 <P>Can you give an example of the expected output?</P> Fri, 23 Aug 2019 16:52:06 GMT https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463367#M10786 diogofgm 2019-08-23T16:52:06Z https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463368#M10787 <P>Also, an image of the current output, and the additional columns you want to see. Annotate them to help us answer your question.</P> Fri, 23 Aug 2019 17:13:46 GMT https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463368#M10787 jpolvino 2019-08-23T17:13:46Z https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463369#M10788 <P>Give this a try</P> <PRE><CODE>| rest /services/admin/LDAP-groups splunk_server=abc | mvexpand roles | search roles=admin_user | stats count by users | table users| eval from="admin_users1" | append [| rest /services/admin/LDAP-groups splunk_server=xyz | mvexpand roles | search roles=admin_user | stats count by users | table users | from="admin_users2"] | stats values(from) as from_combined by users | eval type=case(mvcount(from_combined)=2,"admin_users1 admin_users2", from_combined="admin_users1","In user1 only", true(), "In user2 only") | makemv type | mvexpand type | eval temp=1 | table temp type users | chart values(users) over temp by type </CODE></PRE> Sat, 24 Aug 2019 00:54:11 GMT https://community.splunk.com/t5/Security/how-to-get-string-differences-between-2-columns/m-p/463369#M10788 somesoni2 2019-08-24T00:54:11Z