Difference in columns as output of 2 different searches

[atulitm]

Hello ,
I have data from 2 diff source with same fields as shown below :

index= sourcetype= source= test.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="c"

index= sourcetype= source=test1.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="z"

eval actual_pools = toString(device_name) + ";" + toString(pool_name)

I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt
Thanks

[ololdach]

Hi,

start with an empty search. First, we have to recreate your data:
| makeresults | eval device_name="alpha,beta,gamma" | makemv delim="," device_name |mvexpand device_name | eval pool_name=if(device_name="gamma","c",substr(device_name,1,1))
Then we add a field that holds the source of the pool_name:
| eval pool_source="text1"
Next you append the events from the second query and give it a different pool_source as the last command in the subquery:
| append [| makeresults | eval device_name="alpha,beta,gamma" | makemv delim="," device_name |mvexpand device_name | eval pool_name=if(device_name="gamma","z",substr(device_name,1,1)) | eval pool_source="text2"]
Now you can use transaction to combine the results:
| transaction pool_name,device_name``

In the end it looks like this:

[atulitm]

It doesn't work may be because sorry I think i didn't put question in Splunk language there are not files but source of date , changed details below as per splunk names :

I have data from 2 diff source with same fields as shown below :

index=* sourcetype=* source= test.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="c"

index=* sourcetype=* source=test1.txt
device_name="alpha" pool_name="a"
device_name="beta" pool_name="b"
device_name="gamma" pool_name="z"

eval actual_pools = toString(device_name) + ";" + toString(pool_name)

I am looking for field actual_pools using raw data which i created above which exist in source=test1.txt but not in source=test.txt . Thanks for help .