topic Re: Multivalue differences in Splunk Search

How can i find difference b/w each MV Item?

reverse — Mon, 11 Jul 2022 14:12:56 GMT

How can i find difference b/w each MV Item?
So far i was able to do only one difference ...

Re: Multivalue differences

woodcock — Wed, 31 Jul 2019 19:16:13 GMT

Here are several answers of mine that compare multi-value fields and show the differences:
https://answers.splunk.com/answers/567851/how-can-i-compare-mvfields-and-get-a-diff.html
https://answers.splunk.com/answers/734599/how-to-compare-the-same-search-from-the-previous-d.html
https://answers.splunk.com/answers/319663/how-to-search-the-difference-between-the-values-of.html
https://answers.splunk.com/answers/407106/comparing-multivalue-fields-by-percentage.html

Re: Multivalue differences

reverse — Thu, 01 Aug 2019 03:10:41 GMT

Thanks @woodcock but not able to locate the appropriate solution. please guide

https://answers.splunk.com/answers/760695/generic-solution-to-same-column-value-difference.html

Re: Multivalue differences

woodcock — Thu, 01 Aug 2019 15:36:27 GMT

OK, I get it now, you need diffs between the numbers inside of a single multi-value field! try this:

| makeresults 
| eval mvfield="10 30 100 234 64 432 3 632 87"
| makemv mvfield
| eval mvdiff = tonumber(mvindex(mvfield, 0)) - tonumber(mvindex(mvfield, 1))
| foreach 1 2 3 4 5 6 7 8 9 10 11 12 
    [eval _t3Mp = tonumber(mvindex(mvfield, <<FIELD>>)) - tonumber(mvindex(mvfield, <<FIELD>> + 1))
  | eval mvdiff = mvappend(mvdiff, _t3Mp) ]
| fields - _t3Mp
| eval mvdiff = mvappend(mvdiff, "N/A")

Re: Multivalue differences

reverse — Thu, 01 Aug 2019 15:46:17 GMT

Awesome worked like a charm .. How can i project the differences on a chart now ?
Do i need to expand them first ?

Re: Multivalue differences

woodcock — Thu, 01 Aug 2019 15:55:54 GMT

I am not sure what you mean but maybe just ask a new question because this seems like a separate problem.

Re: Multivalue differences

RobertEikel — Thu, 27 May 2021 14:50:02 GMT

This was much easier for me:

eval diff=mvmap(field1,if(isnull(mvfind(field2,field1)),field1,null))

Re: Multivalue differences

theChain — Mon, 23 Aug 2021 02:17:50 GMT

MVCompare | Splunkbase

Re: Multivalue differences

Pamela — Fri, 01 Oct 2021 11:29:48 GMT

@RobertEikel

Thanks for this small and easy one-liner that solved my issue.

Re: Multivalue differences

pvarelab — Fri, 08 Jul 2022 23:05:19 GMT

Beware thet the second parameter for mvfind is a regex, so it should be limited by "^" and "$" if you want the best match.