How to get non matching value by comparing two multivalued field without using join or append?

[ankitgupta15]

I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records.

eg. |makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")

I want to get the value 3 from fieldA

[to4kawa]

|makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")
| rename COMMENT as "this is sample you provide, from here , the logic"
| stats values(fieldB) as fieldB by fieldA
| where isnull(mvfind(fieldB,fieldA))
| fields fieldA

Hi @ankitgupta15
how about this?

[rmmiller]

Clever, @to4kawa!

[gaurav_maniar]

Hi Ankit,

Try the below code,
| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a

accept and upvote the answer if it helps.