Splunk Search

How do I use the join command to detect if an item is in one list and not another?

ESMaletMa
Explorer

Hi

I need your help for the following:

I have 2 lists: I want to detect when an item is in the list B and NOT in the A

List A: static (from a lookup)
ListB: Dynamic (from a search)

list A:

1

2

3

List B:
1
2
3
4

Result: 4

I do NOT want to detect the oposite when someting is in A and is NOT in B

list A:

1

2

3

4

list B:
1
2
3

Result: None

I tried all the posibilites with "join" command "inner" and "outer" but no luck

thank you very much!

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
Happy Splunking!

View solution in original post

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
Happy Splunking!

ESMaletMa
Explorer

can't see that button sorry,I don't have such button, sorry

0 Karma

renjith_nair
Legend

@ESMaletMa, just below the answer - beside Add Comment "Accept"

Happy Splunking!
0 Karma

ESMaletMa
Explorer

done! Thanks

0 Karma

ESMaletMa
Explorer

It worked, thank you very much!

0 Karma

renjith_nair
Legend

@ESMaletMa, you are welcome. Please "accept" by clicking on the Accept button to close the thread. thanks!

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...