https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705022#M57757 <P>Assuming component1 is a subset of component2 (which you seem to be implying)</P><LI-CODE lang="markup">| eval component=coalesce(component1, component2) | stats count by component | where count=1</LI-CODE> Fri, 22 Nov 2024 10:21:36 GMT ITWhisperer 2024-11-22T10:21:36Z https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705021#M57756 <P>Hi All,</P><P>How can i find the difference between 2 tables?.</P><LI-CODE lang="markup">index=abc task="task1"|dedup component1 |table component1 |append [index=abc task="task2" |dedup component2 |table component2] |table component1 component2</LI-CODE><P>these are the 2 tables. I want to show the extra data which are in component2 and not in component1.</P><P>How can i do it?</P> Fri, 22 Nov 2024 10:15:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705021#M57756 anooshac 2024-11-22T10:15:29Z https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705022#M57757 <P>Assuming component1 is a subset of component2 (which you seem to be implying)</P><LI-CODE lang="markup">| eval component=coalesce(component1, component2) | stats count by component | where count=1</LI-CODE> Fri, 22 Nov 2024 10:21:36 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705022#M57757 ITWhisperer 2024-11-22T10:21:36Z https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705024#M57758 <P>Hi, <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a> , actually it is not subset. its just that im passing different token for taskand getting the 2nd table. In this case will coalesce will work?</P><LI-CODE lang="markup">index=abc task="$task1$"|dedup component1 |table component1 |append [index=abc task="$task2$" |dedup component2 |table component2] |table component1 component2</LI-CODE><P>&nbsp;</P> Fri, 22 Nov 2024 10:31:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705024#M57758 anooshac 2024-11-22T10:31:00Z https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705034#M57760 <P>The coalesce will work it is just that if the count is 1 it could be that it only occurs in component1 or component2 and you would have to do something slightly different if you want to distinguish which set the component comes from</P> Fri, 22 Nov 2024 13:11:03 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Find-the-difference-between-2-tables/m-p/705034#M57760 ITWhisperer 2024-11-22T13:11:03Z