All Apps and Add-ons

Subtract results of subquery from main query

raghu0463
Explorer

Hi Wanted to subract the subquery results from main query. i.e

index=main source=/folder/abc.csv  |table customername - [index=main source=/folder/xxx.csv |table name ] 

can this be achievable ? i want to get only the names which are not common from both the files.

Thanks

0 Karma

to4kawa
SplunkTrust
SplunkTrust
index=main source=/folder/abc.csv OR source=/folder/xxx.csv
| eval name=coalesce(name,customername)  
| eventstats dc(source) as flag by name
| where flag=1 AND source="/folder/abc.csv"
| table name   

Hi, how about this?

0 Karma

raghu0463
Explorer

I apologize, there's small change in my question

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You gotta do it outside of the subsearch like such.

search abc.csv |table name  [search xxx.csv |table name ]
| eval new_field=name_one-name_two
0 Karma

raghu0463
Explorer

hi skoelpin,
im getting the below error

" 'table' command: Invalid argument: 'name=swbsubwg361'"

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!