Getting Data In

How to get non matching value by comparing two multivalued field without using join or append?


I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records.

eg. |makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")

I want to get the value 3 from fieldA

0 Karma

Ultra Champion
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")
| rename COMMENT as "this is sample you provide, from here , the logic"
| stats values(fieldB) as fieldB by fieldA
| where isnull(mvfind(fieldB,fieldA))
| fields fieldA

Hi @ankitgupta15
how about this?


Clever, @to4kawa!

0 Karma


Hi Ankit,

Try the below code,
| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a

accept and upvote the answer if it helps.

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>