https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675882#M12357 <P>Please share your current searches and some sample events, and what your expected result would look like (anonymised of course)</P> Tue, 30 Jan 2024 10:17:53 GMT ITWhisperer 2024-01-30T10:17:53Z https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675871#M12356 <P>Hi,</P><P>I have&nbsp; database1 and database2,&nbsp; I have query1 to get the data from database1 and query2 to get data from database2. query3 to get unique values from databse2 which doesn't exist in database1.</P><P>Now my requirement is to combine the common values in both the databases using a query1 &amp; query2 and also unique values from query2 from database2 which doesn't exist in database1.</P><P>Please provide me the Splunk query.</P> Tue, 30 Jan 2024 09:54:50 GMT https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675871#M12356 Mallik657 2024-01-30T09:54:50Z https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675882#M12357 <P>Please share your current searches and some sample events, and what your expected result would look like (anonymised of course)</P> Tue, 30 Jan 2024 10:17:53 GMT https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675882#M12357 ITWhisperer 2024-01-30T10:17:53Z https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675908#M12358 <P>Result should get common in both databases and also unique/rest values from database2. Please help me with query.</P><TABLE width="209"><TBODY><TR><TD width="74">Databse1</TD><TD width="71">Database2</TD><TD width="64">Result</TD></TR><TR><TD>A</TD><TD>A</TD><TD>A</TD></TR><TR><TD>B</TD><TD>B</TD><TD>B</TD></TR><TR><TD>C</TD><TD>C</TD><TD>C</TD></TR><TR><TD>D&nbsp;</TD><TD>E</TD><TD>E</TD></TR><TR><TD>E</TD><TD>F</TD><TD>F</TD></TR><TR><TD>&nbsp;</TD><TD>G</TD><TD>G</TD></TR><TR><TD>&nbsp;</TD><TD>H</TD><TD>H</TD></TR></TBODY></TABLE> Tue, 30 Jan 2024 13:46:31 GMT https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675908#M12358 Mallik657 2024-01-30T13:46:31Z https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675942#M12359 <LI-CODE lang="markup">| makeresults count=5 | fields - _time | streamstats count as row | eval database1=mvindex(split("ABCDE",""),row - 1) | fields - row | appendcols [| makeresults count=7 | streamstats count as row | eval database2=mvindex(split("ABCEFGH",""),row - 1) | fields - row] | eval result=database2</LI-CODE> Tue, 30 Jan 2024 16:09:46 GMT https://community.splunk.com/t5/Reporting/Query-on-get-Combined-and-Unique-Values/m-p/675942#M12359 ITWhisperer 2024-01-30T16:09:46Z