Getting Data In

Multivalue Field doubt

SoumyaSengupta9
Explorer

I have 2 columns in a table each of which have 1 multivalue field.

ColumnA  ColumnB

abc              abc

def               ghi

ghi

jkl

I want to create a new column where i do an except between the 2 multivalue columns - i.e  as per the above table the result should be def, jkl.

I know we can use ->
| eval columnC = mvfilter(!match(column, searchText))
to achieve the same but the searchText needs to be static & i can't use another fields value. How can i achieve the result i want ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval ColumnC=mvmap(ColumnA,if(isnull(mvfind(ColumnB,ColumnA)),ColumnA,null()))

Note, you need version 8.0.0 or better for the mvmap function.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...