Comparing 2 groups of data

[ckutach]

I have 2 groups of data:

messageId1: ['A', 'B', 'C']

messageId2: ['A', 'E', 'F', 'G', 'T', 'Z']

How do I return the values that are ONLY present in messageId1 and not in messageId2?

So the result for this would be: 'B' and 'C'

[yuanliu]

Or you can use mvexpand

| mvexpand messageId1
| where messageId1 != messageId2
| stats values(messageId1) as unique

[bowesmana]

Use mvmap 

| makeresults
| eval messageId1=split("A,B,C", ",")
| eval messageId2=split("A,E,F,G,T,Z", ",")
| eval only_in_id1=mvmap(messageId1, if(isnull(mvfind(messageId2, messageId1)), messageId1, null()))

mvmap expectes 2 MV fields, so depending on what your actual data looks like, tweak accordingly