https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377121#M170389 <P>I am pretty sure that this only works for simple cases so be sure to evaluate deeply.</P> Thu, 11 Jul 2019 20:12:25 GMT woodcock 2019-07-11T20:12:25Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377117#M170385 <P>I have two mvfields and am looking for a way to show the difference (the missing fields) when comparing mvfield req to mvfield res</P> <P>req<BR /> 34<BR /> 228<BR /> 12558</P> <P>res<BR /> 34<BR /> 228</P> <P>how do I create a third field that would contain 12558?</P> Thu, 11 Jul 2019 14:17:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377117#M170385 taynord 2019-07-11T14:17:10Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377118#M170386 <P>Hi</P> <P>Give a try</P> <PRE><CODE>| makeresults | eval req="34,228,12558" | appendcols [| makeresults | eval res="228,34,4" ] | eval diff = req.",".res | makemv delim="," diff | stats count,list(req) as req,list(res) as res by diff | where count =1 | mvcombine diff delim="," | nomv diff | table req,res,diff </CODE></PRE> Thu, 11 Jul 2019 15:42:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377118#M170386 vnravikumar 2019-07-11T15:42:01Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377119#M170387 <P>See here (don't forget to <CODE>UpVote</CODE><span class="lia-unicode-emoji" title=":disappointed_face:">😞</span><BR /> <A href="https://answers.splunk.com/answers/740480/how-to-compare-characters-in-two-fields-and-return.html">https://answers.splunk.com/answers/740480/how-to-compare-characters-in-two-fields-and-return.html</A><BR /> <A href="https://answers.splunk.com/answers/567851/how-can-i-compare-mvfields-and-get-a-diff.html">https://answers.splunk.com/answers/567851/how-can-i-compare-mvfields-and-get-a-diff.html</A></P> Thu, 11 Jul 2019 15:46:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377119#M170387 woodcock 2019-07-11T15:46:49Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377120#M170388 <P>this works for me thanks! </P> <PRE><CODE>| eval diff = mvzip(req,res) | makemv delim="," diff | stats count,list(req) as req,list(res) as res by diff | where count =1 | mvcombine diff delim="," | nomv diff | table req,res,diff </CODE></PRE> Thu, 11 Jul 2019 20:00:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377120#M170388 taynord 2019-07-11T20:00:05Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377121#M170389 <P>I am pretty sure that this only works for simple cases so be sure to evaluate deeply.</P> Thu, 11 Jul 2019 20:12:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-and-show-the-difference-between-two-mv-fields/m-p/377121#M170389 woodcock 2019-07-11T20:12:25Z