Splunk Dev

how to compare two search results and display only missing values in one searched result respect to other


i have two set of result which give AVC_ID and what i want is compare these two set of result and only display missing AVC_ID with respect to the each searched results.

like search result1

search result 2

expecting output
1. missed value in search result 1 with respect to search result 2
2. missed value in search result 2 with respect to search result 1

i tried below query and getting error:

search 1:
eventtype="li_specific" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |append [search eventtype="hfc" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time ] |table AVC_ID
search 2:
eventtype="ne_config" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |table AVC_ID

comparison query:
eventtype="li_specific" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |append [search eventtype="hfc" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time ] NOT ([search eventtype="ne_config" |eval (AVC_ID=case(searchmatch("AVC*"),"AVC*") |dedup AVC_ID,_time |table AVC_ID |rename AVC_ID as "avc missing in ne config"])

error which i got while running comparison search:
: Error in 'append' command: The last argument must be a subsearch

could you please help me how to achieve this.

Thanks in Advance.


Tags (1)

Splunk Employee
Splunk Employee

Try using multisearch. This isn't super fast, but it did the trick. I added an extra value to each list to play around with when there were multiple differences.

| multisearch 
    [ search source="result1.csv" NOT 
        [ search index="scratchpad" sourcetype="results" source="result2.csv" 
        | fields AVC_ID] 
    | eval OneNotTwo=AVC_ID 
    | fields OneNotTwo] 
    [ search source="result2.csv" NOT 
        [ search index="scratchpad" sourcetype="results" source="result1.csv" 
        | fields AVC_ID] 
    | eval TwoNotOne=AVC_ID 
    | fields TwoNotOne] 
| stats values(OneNotTwo) as OneNotTwo values(TwoNotOne) as TwoNotOne

alt text

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...