Find the difference between 2 tables.

[anooshac]

Hi All,

How can i find the difference between 2 tables?.

index=abc task="task1"|dedup component1 |table component1
|append [index=abc task="task2" |dedup component2 |table component2]
|table component1 component2

these are the 2 tables. I want to show the extra data which are in component2 and not in component1.

How can i do it?

[ITWhisperer · Accepted solution]

Assuming component1 is a subset of component2 (which you seem to be implying)

| eval component=coalesce(component1, component2)
| stats count by component
| where count=1

[anooshac]

Hi, @ITWhisperer , actually it is not subset. its just that im passing different token for taskand getting the 2nd table. In this case will coalesce will work?

index=abc task="$task1$"|dedup component1 |table component1
|append [index=abc task="$task2$" |dedup component2 |table component2]
|table component1 component2

[ITWhisperer]

The coalesce will work it is just that if the count is 1 it could be that it only occurs in component1 or component2 and you would have to do something slightly different if you want to distinguish which set the component comes from