https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486475#M83301 <P>Hi Ankit,</P> <P>Try the below code,<BR /> <CODE>| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a</CODE></P> <P>accept and upvote the answer if it helps.</P> Mon, 13 Jan 2020 14:30:11 GMT gaurav_maniar 2020-01-13T14:30:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486474#M83300 <P>I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records.</P> <P>eg. |makeresults <BR /> |eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")</P> <P>I want to get the value 3 from fieldA</P> Mon, 13 Jan 2020 09:35:28 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486474#M83300 ankitgupta15 2020-01-13T09:35:28Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486475#M83301 <P>Hi Ankit,</P> <P>Try the below code,<BR /> <CODE>| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a</CODE></P> <P>accept and upvote the answer if it helps.</P> Mon, 13 Jan 2020 14:30:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486475#M83301 gaurav_maniar 2020-01-13T14:30:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486476#M83302 <PRE><CODE>|makeresults |eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",") | rename COMMENT as "this is sample you provide, from here , the logic" | stats values(fieldB) as fieldB by fieldA | where isnull(mvfind(fieldB,fieldA)) | fields fieldA </CODE></PRE> <P>Hi @ankitgupta15<BR /> how about this?</P> Mon, 13 Jan 2020 14:55:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486476#M83302 to4kawa 2020-01-13T14:55:00Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486477#M83303 <P>Clever, @to4kawa!</P> Mon, 13 Jan 2020 16:07:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-non-matching-value-by-comparing-two-multivalued-field/m-p/486477#M83303 rmmiller 2020-01-13T16:07:09Z