topic Re: How to find data which does not exist in index1 when compare to index2? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/630014#M218867 <P>Ah I omitted quotation marks in filter.</P><LI-CODE lang="markup">index IN (index1, index2) | eval field = coalesce(field1, field2) ``` common field name ``` | stats values(index) as indices by field ``` which index contains this value? ``` | where mvcount(indices) == 1 AND indices == "index1" ``` only appears in index1 ```</LI-CODE> Wed, 08 Feb 2023 04:58:09 GMT yuanliu 2023-02-08T04:58:09Z How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629222#M218565 <P>I want to compare two index index1 and index2&nbsp; and print values where index1 values does not exists in index2</P> <P>fro ex:</P> <P>Index1. index2</P> <P>field1.&nbsp; &nbsp; &nbsp;field2&nbsp;&nbsp;</P> <P>1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P> <P>2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 3</P> <P>3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 4&nbsp;</P> <P>&nbsp;output</P> <P>&nbsp; &nbsp; &nbsp;2</P> Wed, 01 Feb 2023 20:20:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629222#M218565 directtv999 2023-02-01T20:20:08Z Re: query to find data which does not exist in index1 when compare to index2 https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629225#M218566 <P>Hi</P><P>maybe this inner/outer join post helps you?</P><P><A href="https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-join-and-the/m-p/391288/thread-id/113948" target="_blank">https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-join-and-the/m-p/391288/thread-id/113948</A></P><P>r. Ismo</P> Wed, 01 Feb 2023 20:06:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629225#M218566 isoutamo 2023-02-01T20:06:15Z Re: How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629230#M218569 <P>I wrote this query but not working as expected</P><P><SPAN class="">index</SPAN><SPAN>=index1 OR </SPAN><SPAN class="">index</SPAN><SPAN>=index2 | </SPAN><SPAN class="">eval</SPAN> <SPAN class="">index</SPAN><SPAN>=</SPAN><SPAN class="">if</SPAN><SPAN>(</SPAN><SPAN class="">index</SPAN><SPAN>==</SPAN><SPAN class="">"index1"</SPAN><SPAN>,</SPAN><SPAN class="">1</SPAN><SPAN>,</SPAN><SPAN class="">2</SPAN><SPAN>) | stats </SPAN><SPAN class="">values</SPAN><SPAN>(field1) as field1 by field2, </SPAN><SPAN class="">index</SPAN><SPAN> | </SPAN><SPAN class="">join</SPAN><SPAN> type=left field1 [search </SPAN><SPAN class="">index</SPAN><SPAN>=index1 OR </SPAN><SPAN class="">index</SPAN><SPAN>=index2 | stats </SPAN><SPAN class="">values</SPAN><SPAN>(field2) as field2 by field1, </SPAN><SPAN class="">index</SPAN><SPAN>] | </SPAN><SPAN class="">eval</SPAN><SPAN> missing=</SPAN><SPAN class="">if</SPAN><SPAN>(isnull(field2), field1, </SPAN><SPAN class="">""</SPAN><SPAN>) | search missing!=</SPAN><SPAN class="">""</SPAN><SPAN> | table field1 field2&nbsp;</SPAN><SPAN class="">index</SPAN><SPAN> missing</SPAN></P> Wed, 01 Feb 2023 20:32:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629230#M218569 directtv999 2023-02-01T20:32:38Z Re: How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629307#M218606 <P>Do you mean</P><LI-CODE lang="markup">index IN (index1, index2) | eval field = coalesce(field1, field2) ``` common field name ``` | stats values(index) as indices by field ``` which index contains this value? ``` | where mvcount(indices) == 1 AND indices == index1 ``` only appears in index1 ```</LI-CODE> Thu, 02 Feb 2023 09:50:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629307#M218606 yuanliu 2023-02-02T09:50:51Z Re: How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629435#M218649 <P>when compared field1 with field2, I need data of field1 which does not exist in field2.</P> Fri, 03 Feb 2023 03:46:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629435#M218649 directtv999 2023-02-03T03:46:12Z Re: How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629459#M218666 <P>Can you explain "data of field1"? &nbsp;If you mean the value of field1, it is already coalesced into field. &nbsp;If you prefer to have the name field1, you can just renamed it field1 after the where filter.</P> Fri, 03 Feb 2023 08:05:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629459#M218666 yuanliu 2023-02-03T08:05:11Z Re: How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629509#M218683 <P>yes its value of the field how to print the values only exist in index1 just do table indices? its not giving any output</P> Fri, 03 Feb 2023 14:25:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/629509#M218683 directtv999 2023-02-03T14:25:48Z Re: How to find data which does not exist in index1 when compare to index2? https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/630014#M218867 <P>Ah I omitted quotation marks in filter.</P><LI-CODE lang="markup">index IN (index1, index2) | eval field = coalesce(field1, field2) ``` common field name ``` | stats values(index) as indices by field ``` which index contains this value? ``` | where mvcount(indices) == 1 AND indices == "index1" ``` only appears in index1 ```</LI-CODE> Wed, 08 Feb 2023 04:58:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-data-which-does-not-exist-in-index1-when-compare-to/m-p/630014#M218867 yuanliu 2023-02-08T04:58:09Z