https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502029#M195168 <P>It worked. Thanks.</P> Tue, 15 Oct 2019 14:51:16 GMT graju89 2019-10-15T14:51:16Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502025#M195164 <P>I am running 2 different searches and have to compare the each value in one field with the values in the other field. The display result should show field A values which does not exist in field B.</P> <P>given data:</P> <P>Field A:<BR /> 1111<BR /> 2222<BR /> 2424<BR /> 3333<BR /> 4444</P> <P>Field B:<BR /> 3333<BR /> 1111<BR /> 4444<BR /> 3344<BR /> Results should be something like this table:</P> <P>Field A -- <BR /> 2222<BR /> 2424</P> Tue, 15 Oct 2019 13:49:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502025#M195164 graju89 2019-10-15T13:49:59Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502026#M195165 <P>Hi graju89,<BR /> if results of the second search are less than 50,000, you can run something like this:</P> <PRE><CODE>index=indexA NOT [search index=indexB | rename FieldB AS FieldA | fields FieldA ] | dedup FieldA | sort FieldA | table FieldA </CODE></PRE> <P>If instead you could have more than 50,000 results in the second search, you cannot use subsearches and you have to run a search like this:</P> <PRE><CODE>index=indexA OR index=indexB | rename FieldB AS FieldA | stats dc(index) AS num_indexes values(index) AS index BY FieldA | where num_indexes=1 AND index=indexA | table FieldA </CODE></PRE> <P>Ciao.<BR /> Giuseppe</P> Tue, 15 Oct 2019 14:08:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502026#M195165 gcusello 2019-10-15T14:08:36Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502027#M195166 <P>Assuming your FieldA and FieldB is single valued field, try something like this</P> <PRE><CODE>your search generating FieldA | where NOT [search which generates FieldB |rename FieldB as FieldA ] </CODE></PRE> Tue, 15 Oct 2019 14:08:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502027#M195166 somesoni2 2019-10-15T14:08:56Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502028#M195167 <P>It worked thanks.</P> Tue, 15 Oct 2019 14:51:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502028#M195167 graju89 2019-10-15T14:51:01Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502029#M195168 <P>It worked. Thanks.</P> Tue, 15 Oct 2019 14:51:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502029#M195168 graju89 2019-10-15T14:51:16Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502030#M195169 <P>This is substantially faster in most cases:</P> <PRE><CODE>index=ndxA | search NOT [ search index=ndxB | stats count by FieldB | fields - count ] </CODE></PRE> Tue, 15 Oct 2019 16:03:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-two-fields-from-two-different-searches-and/m-p/502030#M195169 wmyersas 2019-10-15T16:03:22Z