https://community.splunk.com/t5/Splunk-Search/Compare-Two-Different-Fields-in-a-Multisearch/m-p/412662#M118942 <P>I am trying to obtain a list of ids for orders that were abandoned/forgotten and never received a submit. I have a multisearch that finds a list of all ids when they are created and another search that finds the ids when they are submitted. I would like to find all of the values that appear only in the first list. Is there a command to do this without comparing two lookups? Here is my search:<BR /> <CODE>| multisearch <BR /> [ search create call" | extract id ] <BR /> [ search submit call | extract id ] <BR /> | table created_cart_id submitted_cart_id</CODE></P> Wed, 24 Jul 2019 17:11:45 GMT dsitek 2019-07-24T17:11:45Z https://community.splunk.com/t5/Splunk-Search/Compare-Two-Different-Fields-in-a-Multisearch/m-p/412662#M118942 <P>I am trying to obtain a list of ids for orders that were abandoned/forgotten and never received a submit. I have a multisearch that finds a list of all ids when they are created and another search that finds the ids when they are submitted. I would like to find all of the values that appear only in the first list. Is there a command to do this without comparing two lookups? Here is my search:<BR /> <CODE>| multisearch <BR /> [ search create call" | extract id ] <BR /> [ search submit call | extract id ] <BR /> | table created_cart_id submitted_cart_id</CODE></P> Wed, 24 Jul 2019 17:11:45 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Two-Different-Fields-in-a-Multisearch/m-p/412662#M118942 dsitek 2019-07-24T17:11:45Z https://community.splunk.com/t5/Splunk-Search/Compare-Two-Different-Fields-in-a-Multisearch/m-p/412663#M118943 <P>I just posted this but the most obvious solution hit me in the face. After the <CODE>table</CODE> command, rename both fields to be the same, count them, and select only ones that appear once.<BR /> <CODE>rename created_cart_id AS cart_id, submitted_cart_idea AS cart_id | stats count by cart_id | where count=1</CODE></P> Wed, 24 Jul 2019 17:17:58 GMT https://community.splunk.com/t5/Splunk-Search/Compare-Two-Different-Fields-in-a-Multisearch/m-p/412663#M118943 dsitek 2019-07-24T17:17:58Z