Dashboards & Visualizations

Find the difference between 2 tables.

anooshac
Communicator

Hi All,

How can i find the difference between 2 tables?.

index=abc task="task1"|dedup component1 |table component1
|append [index=abc task="task2" |dedup component2 |table component2]
|table component1 component2

these are the 2 tables. I want to show the extra data which are in component2 and not in component1.

How can i do it?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming component1 is a subset of component2 (which you seem to be implying)

| eval component=coalesce(component1, component2)
| stats count by component
| where count=1

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming component1 is a subset of component2 (which you seem to be implying)

| eval component=coalesce(component1, component2)
| stats count by component
| where count=1
0 Karma

anooshac
Communicator

Hi, @ITWhisperer , actually it is not subset. its just that im passing different token for taskand getting the 2nd table. In this case will coalesce will work?

index=abc task="$task1$"|dedup component1 |table component1
|append [index=abc task="$task2$" |dedup component2 |table component2]
|table component1 component2

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The coalesce will work it is just that if the count is 1 it could be that it only occurs in component1 or component2 and you would have to do something slightly different if you want to distinguish which set the component comes from

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...