https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438630#M124850 <P>you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count&gt;1</P> <P>|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count &gt; 1</P> <P>So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.</P> Fri, 01 Feb 2019 14:37:29 GMT lakshman239 2019-02-01T14:37:29Z https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438625#M124845 <P>I have 2 tables contains random msisdn which can be repeated in one another as follows: <BR /> Table1 | Table2<BR /> msisdn1 | msisdn3<BR /> msisdn2 | msisdn1<BR /> msisdn3 | msisdn8<BR /> msisdn5 | msisdn6<BR /> | msisdn2<BR /> | msisdn 4</P> <P>and so on.<BR /> Also row may be different as well as table count/length. </P> <P>So need to check the same msisdn value in both table and save the result in another field.</P> Thu, 31 Jan 2019 14:38:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438625#M124845 mandarpim 2019-01-31T14:38:05Z https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438626#M124846 <P>@mandarpim in the above example, is the desired result will be all the items as the arent "equal" on their perspective table location OR only msisdn 2 4 and 5?</P> Thu, 31 Jan 2019 19:31:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438626#M124846 adonio 2019-01-31T19:31:42Z https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438627#M124847 <P>@mandarpim: Are you looking something like this:<BR /> | makeresults | eval msd="12"<BR /> | append [| makeresults | eval msd="13"]<BR /> | append [| makeresults | eval msd="14"]<BR /> | append [| makeresults | eval msd="12"]<BR /> | fields - _time<BR /> |join max=0 msd [ | makeresults | eval msd="10"<BR /> | append [| makeresults | eval msd="14"]<BR /> | append [| makeresults | eval msd="14"]<BR /> | append [| makeresults | eval msd="14"]]</P> Fri, 01 Feb 2019 06:48:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438627#M124847 vishaltaneja070 2019-02-01T06:48:26Z https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438628#M124848 <P>The final result should be in separate table with a flag found or not-found.</P> Fri, 01 Feb 2019 12:36:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438628#M124848 mandarpim 2019-02-01T12:36:44Z https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438629#M124849 <P>@mandarpim </P> <P>Are you looking for this?</P> <PRE><CODE>YOUR_TABLE1_SEARCH [ YOUR_TABLE2_SEARCH | return Table1 value ] </CODE></PRE> <P><STRONG>Sample Search</STRONG></P> <PRE><CODE>| makeresults | eval _raw=" Table1 value msisdn1 10 msisdn2 40 msisdn3 30 msisdn5 40 " | multikv | search [| makeresults | eval _raw=" Table1 value msisdn2 40 msisdn4 80 " | multikv | return Table1 value ] </CODE></PRE> Fri, 01 Feb 2019 12:58:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438629#M124849 kamlesh_vaghela 2019-02-01T12:58:09Z https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438630#M124850 <P>you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count&gt;1</P> <P>|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count &gt; 1</P> <P>So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.</P> Fri, 01 Feb 2019 14:37:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-the-values-from-different-rows-on-a-table-and/m-p/438630#M124850 lakshman239 2019-02-01T14:37:29Z