<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Multivalue Field doubt in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/Multivalue-Field-doubt/m-p/525803#M88744</link>
    <description>&lt;P&gt;I have 2 columns in a table each of which have 1 multivalue field.&lt;BR /&gt;&lt;BR /&gt;ColumnA&amp;nbsp; ColumnB&lt;/P&gt;&lt;P&gt;abc&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; abc&lt;/P&gt;&lt;P&gt;def&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;ghi&lt;/P&gt;&lt;P&gt;ghi&lt;/P&gt;&lt;P&gt;jkl&lt;BR /&gt;&lt;BR /&gt;I want to create a new column where i do an except between the 2 multivalue columns - i.e&amp;nbsp; as per the above table the result should be def, jkl.&lt;BR /&gt;&lt;BR /&gt;I know we can use -&amp;gt;&lt;BR /&gt;| eval columnC = mvfilter(!match(column, searchText))&lt;BR /&gt;to achieve the same but the searchText needs to be static &amp;amp; i can't use another fields value. How can i achieve the result i want ?&lt;/P&gt;</description>
    <pubDate>Wed, 21 Oct 2020 13:59:18 GMT</pubDate>
    <dc:creator>SoumyaSengupta9</dc:creator>
    <dc:date>2020-10-21T13:59:18Z</dc:date>
    <item>
      <title>Multivalue Field doubt</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Multivalue-Field-doubt/m-p/525803#M88744</link>
      <description>&lt;P&gt;I have 2 columns in a table each of which have 1 multivalue field.&lt;BR /&gt;&lt;BR /&gt;ColumnA&amp;nbsp; ColumnB&lt;/P&gt;&lt;P&gt;abc&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; abc&lt;/P&gt;&lt;P&gt;def&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;ghi&lt;/P&gt;&lt;P&gt;ghi&lt;/P&gt;&lt;P&gt;jkl&lt;BR /&gt;&lt;BR /&gt;I want to create a new column where i do an except between the 2 multivalue columns - i.e&amp;nbsp; as per the above table the result should be def, jkl.&lt;BR /&gt;&lt;BR /&gt;I know we can use -&amp;gt;&lt;BR /&gt;| eval columnC = mvfilter(!match(column, searchText))&lt;BR /&gt;to achieve the same but the searchText needs to be static &amp;amp; i can't use another fields value. How can i achieve the result i want ?&lt;/P&gt;</description>
      <pubDate>Wed, 21 Oct 2020 13:59:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Multivalue-Field-doubt/m-p/525803#M88744</guid>
      <dc:creator>SoumyaSengupta9</dc:creator>
      <dc:date>2020-10-21T13:59:18Z</dc:date>
    </item>
    <item>
      <title>Re: Multivalue Field doubt</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/Multivalue-Field-doubt/m-p/525841#M88747</link>
      <description>&lt;LI-CODE lang="markup"&gt;| eval ColumnC=mvmap(ColumnA,if(isnull(mvfind(ColumnB,ColumnA)),ColumnA,null()))&lt;/LI-CODE&gt;&lt;P&gt;Note, you need version 8.0.0 or better for the mvmap function.&lt;/P&gt;</description>
      <pubDate>Wed, 21 Oct 2020 15:38:00 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/Multivalue-Field-doubt/m-p/525841#M88747</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2020-10-21T15:38:00Z</dc:date>
    </item>
  </channel>
</rss>

