https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421670#M121093 <P>No luck @somesoni2.. </P> Tue, 23 Apr 2019 08:36:59 GMT pench2k19 2019-04-23T08:36:59Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421668#M121091 <P>Hi team,</P> <P>I have two queries as follows</P> <P><STRONG>query1:</STRONG></P> <PRE><CODE>|inputlookup abc.csv |table file sla_time </CODE></PRE> <P><STRONG>query2:</STRONG></P> <PRE><CODE>index=xxx source=yyyy |table file2 </CODE></PRE> <P><STRONG>file2</STRONG> values are subset of <STRONG>file</STRONG> values. I want to print the difference between the <STRONG>file</STRONG> and <STRONG>file2</STRONG> fields along with the <STRONG>sla_time</STRONG> from the first query.</P> <P>Can you help me here</P> <P>@jkat54 @vnravikumar </P> Mon, 22 Apr 2019 17:50:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421668#M121091 pench2k19 2019-04-22T17:50:30Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421669#M121092 <P>Give this a try (giving list of file and corresponding sla_time from lookup abc.csv, which doesn't have a matching row in the search)</P> <PRE><CODE>index=xxx source=yyyy |stats count by file2 | rename file2 as file | append [|inputlookup abc.csv |table file sla_time] | stats values(sla_time) as sla_time values(count) as count by file | where isnull(count) </CODE></PRE> Mon, 22 Apr 2019 18:06:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421669#M121092 somesoni2 2019-04-22T18:06:17Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421670#M121093 <P>No luck @somesoni2.. </P> Tue, 23 Apr 2019 08:36:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421670#M121093 pench2k19 2019-04-23T08:36:59Z https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421671#M121094 <P>Hi @pench2k19,<BR /> You can use set difference for this purpose. This is similar to set in normal programming language or mathematics so this is even easy to understood. At the end use lookup command to get sla_time field.</P> <PRE><CODE>| set diff [|inputlookup abc.csv |table file] [index=xxx source=yyyy | rename file2 as file|table file] | lookup abc.csv file output sla_time </CODE></PRE> <P>Hope this helps!!!</P> Tue, 23 Apr 2019 13:37:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-the-difference-of-two-query-results/m-p/421671#M121094 VatsalJagani 2019-04-23T13:37:43Z