Security

how to get string differences between 2 columns

shihabno
New Member

My query1 returns stats list and query2 is a subsearch that's retun another stats list. i added it with appendcols.
I want to have another 2 columns, col3:not in col1 but in col2, col4:not in col2 but in col1.
all columns are strings or alphanumeric.

| rest /services/admin/LDAP-groups splunk_server=abc
| mvexpand roles
| search roles=admin_user
| stats values(roles) as roles list(users) as admin_users1
| appendcols
[| rest /services/admin/LDAP-groups splunk_server=xyz
| mvexpand roles
| search roles=admin_user
| stats list(users) as admin_users2]

Result i looking(last 2 columns is what i am looking)

admin_users1 admin_users2 admin(users1-users2) admin(users2-users1)
A |A |B |C
B |C |D |F
D |E
E |F

0 Karma

somesoni2
Revered Legend

Give this a try

| rest /services/admin/LDAP-groups splunk_server=abc
| mvexpand roles
| search roles=admin_user
| stats count by users | table users| eval from="admin_users1"
| append
[| rest /services/admin/LDAP-groups splunk_server=xyz
| mvexpand roles
| search roles=admin_user
| stats count by users | table users | from="admin_users2"]
| stats values(from) as from_combined by users
| eval type=case(mvcount(from_combined)=2,"admin_users1 admin_users2", from_combined="admin_users1","In user1 only", true(), "In user2 only")
| makemv type | mvexpand type 
| eval temp=1 
| table temp type users
| chart values(users) over temp by type
0 Karma

jpolvino
Builder

Also, an image of the current output, and the additional columns you want to see. Annotate them to help us answer your question.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Can you give an example of the expected output?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...