Splunk Search

Comparing 2 groups of data


I have 2 groups of data:

messageId1: ['A', 'B', 'C']

messageId2: ['A', 'E', 'F', 'G', 'T', 'Z']


How do I return the values that are ONLY present in messageId1 and not in messageId2?

So the result for this would be: 'B' and 'C'

Labels (1)
0 Karma


Or you can use mvexpand

| mvexpand messageId1
| where messageId1 != messageId2
| stats values(messageId1) as unique


Tags (2)
0 Karma


Use mvmap 

| makeresults
| eval messageId1=split("A,B,C", ",")
| eval messageId2=split("A,E,F,G,T,Z", ",")
| eval only_in_id1=mvmap(messageId1, if(isnull(mvfind(messageId2, messageId1)), messageId1, null()))

mvmap expectes 2 MV fields, so depending on what your actual data looks like, tweak accordingly

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...