How to return the INTERSET and Difference from two fields?

[andres91302]

Hello everyone I hope you are all well and safe!

My data= Two fields that contain IDS from clientes of a tea shop, fields= ID_SUGGAR, ID_DOUBLE 

What I want to know: I want to be able to identify with a function what IDS are in BOTH ID_SUGGAR AND ID_DOUBLE , and also what IDS are only exclusive or only present in ID_SUGGAR (Which means these IDS are not in ID_DOUBLE)

for example:
ID_SUGGAR="5,1,45,78,100,200,300"
ID_DOUBLE="5,1,45,78"
My goal is to have a table or a fild that will tell me, the IDS that are in ID_SUGGAR and NOT in ID_DOUBLE are = 100,200,300
Thank you to anyone who can link some documentation about it I Love you all 

[bowesmana]

Try this

| makeresults
| fields - _time
| eval ID_SUGGAR="5,1,45,78,100,200,300"
| eval ID_DOUBLE="5,1,45,78"
| eval comment="From here"
| eval ID_SUGGAR=split(ID_SUGGAR, ",")
| eval ID_DOUBLE=split(ID_DOUBLE, ",")
| mvexpand ID_SUGGAR
| where !ID_SUGGAR IN(ID_DOUBLE)
| stats values(ID_SUGGAR) as SuggarValuesNotInDouble

To some extent this will depend on the rest of your data and what you intend to do

Here is an 'in_row' version which uses mvmap, which is only available from Splunk version 8.

| makeresults
| fields - _time
| eval ID_SUGGAR="5,1,45,78,100,200,300"
| eval ID_DOUBLE="5,1,45,78"
| eval comment="From here"
| eval ID_SUGGAR=split(ID_SUGGAR, ",")
| eval ID_DOUBLE=split(ID_DOUBLE, ",")
| eval SuggarNotInDouble=mvmap(ID_SUGGAR, if(!ID_SUGGAR IN(ID_DOUBLE), ID_SUGGAR, null()))

Hope this helps