How to compare a field with latest two events?

[vrmandadi]

Hello SPLUNKERS,

I have a field called GPU which has values GPU0,GPU1,GPU2,GPU3. etc ..Some might have 7 values some might have 4 and some might have 3 for each host... I  want to compare   the current GPU and with the previous event for that host and if there is a difference I want to show what is the difference  and if its same then show no difference .For example 

Current Event : GPU0,GPU1,GPU2,GPU3,GPU4,GPU5,GPU6,GPU7

Previous Event : GPU0,GPU2,GPU6,GPU7

Thanks in Advance

I want to output the difference :GPU1,GPU3,GPU4,GPU5 

[bowesmana]

See this search example that uses your example to show differences.

It created multivalue fields for the GPU values and then uses a pair of MVMAP statements to stitch together new entries in the second event as well as entries no longer in second event

| makeresults
``` Make 2 events containing different GPUs ```
| eval event_1="GPU0,GPU2,GPU6,GPU7"
| eval event_2="GPU0,GPU1,GPU2,GPU3,GPU4,GPU5,GPU6,GPU7"
| eval gpus_1=split(event_1, ",")
| eval gpus_2=split(event_2, ",")
``` Calculate differences - only new additions in this example ```
| eval differences_1_vs_2=mvappend(mvmap(gpus_2, if(isnull(mvfind(gpus_1, gpus_2)), gpus_2, null())), mvmap(gpus_1, if(isnull(mvfind(gpus_2, gpus_1)), gpus_1, null())))
``` Now let's try reductions and addition in same event ```
| eval event_3="GPU1,GPU7,GPU8"
| eval gpus_3=split(event_3, ",")
| eval differences_2_vs_3=mvappend(mvmap(gpus_3, if(isnull(mvfind(gpus_2, gpus_3)), gpus_3, null())), mvmap(gpus_2, if(isnull(mvfind(gpus_3, gpus_2)), gpus_2, null())))
``` Now no changes ```
| eval event_4="GPU1,GPU7,GPU8"
| eval gpus_4=split(event_4, ",")
| eval differences_3_vs_4=mvappend(mvmap(gpus_3, if(isnull(mvfind(gpus_4, gpus_3)), gpus_3, null())), mvmap(gpus_4, if(isnull(mvfind(gpus_3, gpus_4)), gpus_4, null())))