topic Re: What is the command to check if a field exists in one column but not in the other column? in Splunk Search

What is the command to check if a field exists in one column but not in the other column?

avivn — Tue, 20 Sep 2016 15:45:20 GMT

hello

what is the command to check if a field exists in one column but not the other?

for example, to count the "10.2.3.3" because it exists in the source column but not in the target column :

source_             |target
10.1.2.3             |10.1.2.3
10.2.3.3             |10.2.2.2

thanks

somesoni2 — Tue, 20 Sep 2016 16:00:17 GMT

There won't be a straight forward command to the comparison. Try this subsearch method

your base search | where NOT [search yourbasesearch | stats count by target | table target | rename target as source] | stats count by source

inventsekar — Tue, 20 Sep 2016 16:00:56 GMT

try this....

yoursearch | table source, target | where source!=target

avivn — Wed, 21 Sep 2016 07:47:33 GMT

not working ,,,,

avivn — Wed, 21 Sep 2016 07:53:51 GMT

not working ...

inventsekar — Wed, 21 Sep 2016 08:09:28 GMT

You simply want to list or you want to count as well?

sjalexander — Wed, 21 Sep 2016 12:31:24 GMT

I downvoted this post because not an answer

sidbisht — Sat, 25 Jul 2020 16:30:15 GMT

Although the question is 4 years old I had encountered something similar for an Alert. Please try this

to4kawa — Sun, 26 Jul 2020 01:37:23 GMT

@sidbisht your creating temp1 is interesting.

How about this query?
For comparing fields, make multi value and use match(), I think.