topic Re: How do you compare two results? in Alerting

How do you compare two results?

btawiah — Tue, 02 Apr 2019 16:26:48 GMT

I have a table(main table).csv with field location.

I have raw logs that includes field location

main table.csv
location_field
A
B
C

Raw logs 
location_field
A 
B

Please, I need help with a query that will check raw logs against main table and give a result of C missing

search result should return C

Re: How do you compare two results?

Vijeta — Tue, 02 Apr 2019 16:38:59 GMT

@btawiah-can you extract the filed that has location from your raw logs? If not then you will have to provide a log sample.
Once you extract the field say loc , the query can be something like this-

 |inputlookup maintable.csv| join type=outer location[search index=* | rename loc as location| fields source]| where ISNULL(source)

Re: How do you compare two results?

btawiah — Tue, 02 Apr 2019 16:50:48 GMT

@Vijeta i actually updated the question. I dont have to extract fields because that already exist. I only need to get the difference and output the one from raw logs since that is not in the main table location field.

Re: How do you compare two results?

Vijeta — Tue, 02 Apr 2019 16:57:37 GMT

@btawiah Try running this query, write the name of your index instead of "yourindexname"

  |inputlookup maintable.csv| join type=outer location_field[search index="yourindexname"| fields source]| where ISNULL(source)

Re: How do you compare two results?

btawiah — Wed, 03 Apr 2019 16:28:02 GMT

Whenever results return 0 that means those locations are not in main table

Re: How do you compare two results?

btawiah — Wed, 03 Apr 2019 16:28:27 GMT

Whenever results return 0 that means those locations are not in main table