topic Different values in column between two rows in Splunk Search

Different values in column between two rows

vb1612 — Wed, 21 Aug 2019 20:07:04 GMT

Hi , I am having data like

               Col1                Col2(created from values())

row 1 X A B C
row 2 Y A B

how to get column with value C as its unique value in col2

Thanks

Re: Different values in column between two rows

vb1612 — Wed, 21 Aug 2019 20:33:38 GMT

to clarify

col1 having X
Col2 having A B C (multivalues)

second row col2 A B

Re: Different values in column between two rows

nareshinsvu — Thu, 22 Aug 2019 00:53:33 GMT

Not very clear. Do you want seperate row for "C" ?

<your base search>| makemv delim=" " col2|mvexpand col2

Re: Different values in column between two rows

vb1612 — Thu, 22 Aug 2019 02:38:48 GMT

as A B already there in one row in single column , so want difference between two rows which is C

Re: Different values in column between two rows

nareshinsvu — Thu, 22 Aug 2019 02:51:07 GMT

Not sure if this helps. You can use the logic according to your requirements. Hope it helps

<your base search>| makemv delim=" " col2|mvexpand col2 | stats count(col2) as count by col2 | eval new_column=if((count=1),col2,"") | table new_column