Splunk Dev

List comparsion of field values

skillfulobj
Explorer

sample event 1:
id:12345
fcount:20
component:value1
time:2021:04:26

sample event2:
id:12346
fcount:200
component:value2
time:2021:04:26

sample event 3:
id:12347
fcount:20
component:value1
time:2021:04:27

sample event 4:
id:12348
fcount:200
component:value3
time:2021:04:27


i have list of values for my field "component" , lets say i have value1 , value2 , value3... value15 , which are coming part of my events

for given a day my events are related only to components of value1, value2 , i want to display the components which are not received for the particular given day

Example : in above 4 events on 2021:04:26 i got components of value1 and value2 where i didnt receive components for value3..to value 15 , i want to display them which not received

Labels (1)
Tags (2)
0 Karma

skillfulobj
Explorer

@MuS  could you please share your thoughts on this

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...