Getting Data In

How to get non matching value by comparing two multivalued field without using join or append?


I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records.

eg. |makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")

I want to get the value 3 from fieldA

0 Karma

|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")
| rename COMMENT as "this is sample you provide, from here , the logic"
| stats values(fieldB) as fieldB by fieldA
| where isnull(mvfind(fieldB,fieldA))
| fields fieldA

Hi @ankitgupta15
how about this?


Clever, @to4kawa!

0 Karma

Hi Ankit,

Try the below code,
| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a

accept and upvote the answer if it helps.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!