https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544644#M4901 <DIV class="lia-message-author-avatar lia-component-author-avatar lia-component-message-view-widget-author-avatar"><DIV class="UserAvatar lia-user-avatar lia-component-common-widget-user-avatar"><P>hELLO&nbsp; sir</P></DIV></DIV><DIV class="lia-message-author-with-avatar"><SPAN class="UserName lia-user-name lia-user-rank-Influencer lia-component-message-view-widget-author-username"><BR />thank you so much for tryign to help I am very grateful for that.<BR /><BR />Lets make up the following&nbsp; data.<BR /><BR />ID_SUGGAR="5,1,45,78,100,200,300"<BR />ID_DOUBLE="5,1,45,78"<BR />My goal is to have a table or a fild that will tell me, the IDS that are in&nbsp;ID_SUGGAR and NOT in&nbsp;ID_DOUBLE are = 100,200,300<BR /><BR />Thank you so much&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206061">@scelikok</a>&nbsp; for your kind help Im sending you&nbsp; hug from a distance! have a great weekend stat safe and thank you so much</SPAN></DIV> Sat, 20 Mar 2021 20:38:36 GMT andres91302 2021-03-20T20:38:36Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544331#M4886 <P>Hello everyone I hope you are all well and safe!</P><P>My data= Two fields that contain IDS from clientes of a tea shop, fields= ID_SUGGAR, ID_DOUBLE&nbsp;<BR /><BR />What I want to know: I want to be able to identify with a function what IDS are in BOTH&nbsp;ID_SUGGAR AND ID_DOUBLE , and also what IDS are only exclusive or only present in ID_SUGGAR (Which means these IDS are not in ID_DOUBLE)<BR /><BR />Thank you to anyone who can link some documentation about it I Love you all&nbsp;</P> Thu, 18 Mar 2021 13:39:23 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544331#M4886 andres91302 2021-03-18T13:39:23Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544397#M4891 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232004">@andres91302</a>,</P><P>Please try below;</P><LI-CODE lang="markup">| eval ID=mvzip(ID_SUGGAR,ID_DOUBLE) | makemv delim="," ID | mvexpand ID | eval IDS_SUGGAR=if(ID_SUGGAR==ID,ID_SUGGAR,null()) | eval IDS_DOUBLE=if(ID_DOUBLE==ID,ID_DOUBLE,null()) | eval IDS_BOTH=if(ID_SUGGAR==ID_DOUBLE,ID_SUGGAR,null()) | stats dc(IDS_*) as * by ID</LI-CODE> Thu, 18 Mar 2021 19:13:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544397#M4891 scelikok 2021-03-18T19:13:26Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544500#M4894 <P><SPAN>Hi man! this did not work.. for me. I would like to thank you for trying to help me</SPAN></P> Fri, 19 Mar 2021 13:10:14 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544500#M4894 andres91302 2021-03-19T13:10:14Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544566#M4896 <P>If you can post a sample data, I can find why it didn't work</P> Fri, 19 Mar 2021 19:48:12 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544566#M4896 scelikok 2021-03-19T19:48:12Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544644#M4901 <DIV class="lia-message-author-avatar lia-component-author-avatar lia-component-message-view-widget-author-avatar"><DIV class="UserAvatar lia-user-avatar lia-component-common-widget-user-avatar"><P>hELLO&nbsp; sir</P></DIV></DIV><DIV class="lia-message-author-with-avatar"><SPAN class="UserName lia-user-name lia-user-rank-Influencer lia-component-message-view-widget-author-username"><BR />thank you so much for tryign to help I am very grateful for that.<BR /><BR />Lets make up the following&nbsp; data.<BR /><BR />ID_SUGGAR="5,1,45,78,100,200,300"<BR />ID_DOUBLE="5,1,45,78"<BR />My goal is to have a table or a fild that will tell me, the IDS that are in&nbsp;ID_SUGGAR and NOT in&nbsp;ID_DOUBLE are = 100,200,300<BR /><BR />Thank you so much&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206061">@scelikok</a>&nbsp; for your kind help Im sending you&nbsp; hug from a distance! have a great weekend stat safe and thank you so much</SPAN></DIV> Sat, 20 Mar 2021 20:38:36 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544644#M4901 andres91302 2021-03-20T20:38:36Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544668#M4907 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232004">@andres91302</a>,</P><P>I was assuming the values are in separate events. Below should work based on your sample;</P><LI-CODE lang="markup">| makemv delim="," ID_SUGGAR | makemv delim="," ID_DOUBLE | eval IDS=mvmap(ID_SUGGAR,if(isnull(mvfind(ID_DOUBLE,ID_SUGGAR)),ID_SUGGAR,null()))</LI-CODE><P>&nbsp;</P> Sun, 21 Mar 2021 05:42:57 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544668#M4907 scelikok 2021-03-21T05:42:57Z https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544684#M4910 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/206061">@scelikok</a>&nbsp; this was AWESOME 10/10 thank you so so so much I have also being search your replies for others post and man... you have helped a lot for this is such a great help and I want to praise your job!!!! thank so so so so so so much</P> Sun, 21 Mar 2021 15:02:25 GMT https://community.splunk.com/t5/Monitoring-Splunk/How-to-count-equal-and-different-elements-between-two-fields/m-p/544684#M4910 andres91302 2021-03-21T15:02:25Z