Archive
Highlighted

How to find unmatched value present in the list?

Path Finder

Let suppose,In a list(ownername) as ownername we are having following values,
shyam
ram
Shyam
Shyam

And we have to take out first unmatched value i.e. "ram" and we do not know about what is present in the list.

Tags (1)
0 Karma
Highlighted

Re: How to find unmatched value present in the list?

SplunkTrust
SplunkTrust

What should be the output if the list is this??

Shyam
shyam
ram
Shyam
0 Karma
Highlighted

Re: How to find unmatched value present in the list?

SplunkTrust
SplunkTrust

Also give this a try.

your current search giving field owner_name
| eval temp=mvdedup(owner_name)
| eval unmatched=if(mvcount(temp)=1,"Only Single type entries present", mvindex(temp,1))
0 Karma
Highlighted

Re: How to find unmatched value present in the list?

Path Finder

Output should be Ram

0 Karma
Highlighted

Re: How to find unmatched value present in the list?

SplunkTrust
SplunkTrust

Not sure if you tried my earlier query. Try this variation as well

your current search giving field owner_name
 | eval temp=mvdedup(lower(owner_name))
 | eval unmatched=if(mvcount(temp)=1,"Only Single type entries present", mvindex(temp,1))
0 Karma