topic How to compare two fields data from appendcols in Splunk Search

How to compare two fields data from appendcols

joomla — Wed, 28 Sep 2022 10:09:27 GMT

Hi Community,

I need support to know how I can get the non-existent values from the two fields obtained from the "appendcols" command output.

Example of Splunk output in table format below:

1st_Field 2nd_Field

1111 2222

empty 3333

empty 1111

I am able to get 1111 after using the lookup command but I want to get 2222 and 3333 only as those are not present in 1st Field.

ITWhisperer — Wed, 28 Sep 2022 10:46:45 GMT

You could append the lookup (inputlookup) and then remove the events which have had successful lookups i.e. values in 1st_Field

joomla — Wed, 28 Sep 2022 15:20:52 GMT

Ok so I created the two different outlookup in main search and appendcols subseach and then used lookup command. This solved my purpose.