https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-searches-to-find-values-in-one-search-and-not/m-p/490955#M137079 <P>Something like this:</P> <PRE><CODE>| makeresults | eval _raw = "list item1 item2 item3" | multikv forceheader=1 | eval inList1 = "Y" | appendcols [| makeresults | eval _raw = "list item1 item2 item3 item4 item5" | multikv forceheader=1 | table list] | eval inList2 = if(inList1 = "Y", "N", "Y") | where inList2 = "Y" | table list </CODE></PRE> Thu, 12 Mar 2020 05:05:39 GMT anmolpatel 2020-03-12T05:05:39Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-searches-to-find-values-in-one-search-and-not/m-p/490954#M137078 <P>I have two datasets in separate indexes that I would like to compare. i.e. </P> <H2>dataset from <CODE>search1</CODE>:</H2> <PRE><CODE>item1 item2 item3 </CODE></PRE> <H2>dataset from <CODE>search2</CODE>:</H2> <PRE><CODE>item1 item2 item3 item4 item5 </CODE></PRE> <P>I would like to produce a table that gives me a table of items that exist in <CODE>search2</CODE> and not in <CODE>search1</CODE>. i.e. </P> <PRE><CODE>itemfield searchname` ------------------------------------- item4 search2 item5 search2 </CODE></PRE> <P>How would I do this? </P> Wed, 11 Mar 2020 20:10:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-searches-to-find-values-in-one-search-and-not/m-p/490954#M137078 zachsisinst 2020-03-11T20:10:05Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-searches-to-find-values-in-one-search-and-not/m-p/490955#M137079 <P>Something like this:</P> <PRE><CODE>| makeresults | eval _raw = "list item1 item2 item3" | multikv forceheader=1 | eval inList1 = "Y" | appendcols [| makeresults | eval _raw = "list item1 item2 item3 item4 item5" | multikv forceheader=1 | table list] | eval inList2 = if(inList1 = "Y", "N", "Y") | where inList2 = "Y" | table list </CODE></PRE> Thu, 12 Mar 2020 05:05:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-searches-to-find-values-in-one-search-and-not/m-p/490955#M137079 anmolpatel 2020-03-12T05:05:39Z