Monitoring Splunk

How to count equal and different elements between two fields (crossvalidation)

andres91302
Communicator

Hello everyone I hope you are all well and safe!

My data= Two fields that contain IDS from clientes of a tea shop, fields= ID_SUGGAR, ID_DOUBLE 

What I want to know: I want to be able to identify with a function what IDS are in BOTH ID_SUGGAR AND ID_DOUBLE , and also what IDS are only exclusive or only present in ID_SUGGAR (Which means these IDS are not in ID_DOUBLE)

Thank you to anyone who can link some documentation about it I Love you all 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @andres91302,

I was assuming the values are in separate events. Below should work based on your sample;

| makemv delim="," ID_SUGGAR 
| makemv delim="," ID_DOUBLE
| eval IDS=mvmap(ID_SUGGAR,if(isnull(mvfind(ID_DOUBLE,ID_SUGGAR)),ID_SUGGAR,null()))

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @andres91302,

I was assuming the values are in separate events. Below should work based on your sample;

| makemv delim="," ID_SUGGAR 
| makemv delim="," ID_DOUBLE
| eval IDS=mvmap(ID_SUGGAR,if(isnull(mvfind(ID_DOUBLE,ID_SUGGAR)),ID_SUGGAR,null()))

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

andres91302
Communicator

@scelikok  this was AWESOME 10/10 thank you so so so much I have also being search your replies for others post and man... you have helped a lot for this is such a great help and I want to praise your job!!!! thank so so so so so so much

0 Karma

scelikok
SplunkTrust
SplunkTrust

If you can post a sample data, I can find why it didn't work

If this reply helps you an upvote and "Accept as Solution" is appreciated.

andres91302
Communicator

hELLO  sir


thank you so much for tryign to help I am very grateful for that.

Lets make up the following  data.

ID_SUGGAR="5,1,45,78,100,200,300"
ID_DOUBLE="5,1,45,78"
My goal is to have a table or a fild that will tell me, the IDS that are in ID_SUGGAR and NOT in ID_DOUBLE are = 100,200,300

Thank you so much @scelikok  for your kind help Im sending you  hug from a distance! have a great weekend stat safe and thank you so much
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @andres91302,

Please try below;

| eval ID=mvzip(ID_SUGGAR,ID_DOUBLE) 
| makemv delim="," ID 
| mvexpand ID 
| eval IDS_SUGGAR=if(ID_SUGGAR==ID,ID_SUGGAR,null()) 
| eval IDS_DOUBLE=if(ID_DOUBLE==ID,ID_DOUBLE,null()) 
| eval IDS_BOTH=if(ID_SUGGAR==ID_DOUBLE,ID_SUGGAR,null()) 
| stats dc(IDS_*) as * by ID
If this reply helps you an upvote and "Accept as Solution" is appreciated.

andres91302
Communicator

Hi man! this did not work.. for me. I would like to thank you for trying to help me

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...