Splunk Search

Comparing 2 groups of data

ckutach
Engager

I have 2 groups of data:

messageId1: ['A', 'B', 'C']

messageId2: ['A', 'E', 'F', 'G', 'T', 'Z']

 

How do I return the values that are ONLY present in messageId1 and not in messageId2?

So the result for this would be: 'B' and 'C'

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Or you can use mvexpand

| mvexpand messageId1
| where messageId1 != messageId2
| stats values(messageId1) as unique

 

Tags (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Use mvmap 

| makeresults
| eval messageId1=split("A,B,C", ",")
| eval messageId2=split("A,E,F,G,T,Z", ",")
| eval only_in_id1=mvmap(messageId1, if(isnull(mvfind(messageId2, messageId1)), messageId1, null()))

mvmap expectes 2 MV fields, so depending on what your actual data looks like, tweak accordingly

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...