topic Re: Comparing 2 groups of data in Splunk Search

Comparing 2 groups of data

ckutach — Fri, 10 Mar 2023 05:03:39 GMT

I have 2 groups of data:

messageId1: ['A', 'B', 'C']

messageId2: ['A', 'E', 'F', 'G', 'T', 'Z']

How do I return the values that are ONLY present in messageId1 and not in messageId2?

So the result for this would be: 'B' and 'C'

Re: Comparing 2 groups of data

bowesmana — Fri, 10 Mar 2023 05:30:04 GMT

Use mvmap

| makeresults | eval messageId1=split("A,B,C", ",") | eval messageId2=split("A,E,F,G,T,Z", ",") | eval only_in_id1=mvmap(messageId1, if(isnull(mvfind(messageId2, messageId1)), messageId1, null()))

mvmap expectes 2 MV fields, so depending on what your actual data looks like, tweak accordingly

Re: Comparing 2 groups of data

yuanliu — Fri, 10 Mar 2023 05:36:15 GMT

Or you can use mvexpand

| mvexpand messageId1 | where messageId1 != messageId2 | stats values(messageId1) as unique