topic Re: How do I use the join command to detect if an item is in one list and not another? in Splunk Search

How do I use the join command to detect if an item is in one list and not another?

ESMaletMa — Wed, 07 Nov 2018 14:36:07 GMT

I need your help for the following:

I have 2 lists: I want to detect when an item is in the list B and NOT in the A

List A: static (from a lookup)
ListB: Dynamic (from a search)

list A:

1

2

3

List B:
1
2
3
4

Result: 4

I do NOT want to detect the oposite when someting is in A and is NOT in B

list A:

1

2

3

4

list B:
1
2
3

Result: None

I tried all the posibilites with "join" command "inner" and "outer" but no luck

thank you very much!

Re: How do I use the join command to detect if an item is in one list and not another?

renjith_nair — Wed, 07 Nov 2018 15:00:41 GMT

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]

Re: How do I use the join command to detect if an item is in one list and not another?

ESMaletMa — Wed, 07 Nov 2018 15:07:16 GMT

It worked, thank you very much!

Re: How do I use the join command to detect if an item is in one list and not another?

renjith_nair — Wed, 07 Nov 2018 15:16:31 GMT

@ESMaletMa, you are welcome. Please "accept" by clicking on the Accept button to close the thread. thanks!

Re: How do I use the join command to detect if an item is in one list and not another?

ESMaletMa — Wed, 07 Nov 2018 15:33:38 GMT

can't see that button sorry,I don't have such button, sorry

Re: How do I use the join command to detect if an item is in one list and not another?

renjith_nair — Thu, 08 Nov 2018 05:40:55 GMT

@ESMaletMa, just below the answer - beside Add Comment "Accept"

Re: How do I use the join command to detect if an item is in one list and not another?

ESMaletMa — Thu, 08 Nov 2018 07:36:22 GMT

done! Thanks