- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
anooshac
Communicator
11-22-2024
02:15 AM
Hi All,
How can i find the difference between 2 tables?.
index=abc task="task1"|dedup component1 |table component1
|append [index=abc task="task2" |dedup component2 |table component2]
|table component1 component2
these are the 2 tables. I want to show the extra data which are in component2 and not in component1.
How can i do it?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-22-2024
02:21 AM
Assuming component1 is a subset of component2 (which you seem to be implying)
| eval component=coalesce(component1, component2)
| stats count by component
| where count=1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-22-2024
02:21 AM
Assuming component1 is a subset of component2 (which you seem to be implying)
| eval component=coalesce(component1, component2)
| stats count by component
| where count=1
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
anooshac
Communicator
11-22-2024
02:31 AM
Hi, @ITWhisperer , actually it is not subset. its just that im passing different token for taskand getting the 2nd table. In this case will coalesce will work?
index=abc task="$task1$"|dedup component1 |table component1
|append [index=abc task="$task2$" |dedup component2 |table component2]
|table component1 component2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer

SplunkTrust
11-22-2024
05:11 AM
The coalesce will work it is just that if the count is 1 it could be that it only occurs in component1 or component2 and you would have to do something slightly different if you want to distinguish which set the component comes from
