Splunk Search

How do I use the join command to detect if an item is in one list and not another?

ESMaletMa
Explorer

Hi

I need your help for the following:

I have 2 lists: I want to detect when an item is in the list B and NOT in the A

List A: static (from a lookup)
ListB: Dynamic (from a search)

list A:

1

2

3

List B:
1
2
3
4

Result: 4

I do NOT want to detect the oposite when someting is in A and is NOT in B

list A:

1

2

3

4

list B:
1
2
3

Result: None

I tried all the posibilites with "join" command "inner" and "outer" but no luck

thank you very much!

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
---
What goes around comes around. If it helps, hit it with Karma 🙂

ESMaletMa
Explorer

can't see that button sorry,I don't have such button, sorry

0 Karma

renjith_nair
Legend

@ESMaletMa, just below the answer - beside Add Comment "Accept"

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

ESMaletMa
Explorer

done! Thanks

0 Karma

ESMaletMa
Explorer

It worked, thank you very much!

0 Karma

renjith_nair
Legend

@ESMaletMa, you are welcome. Please "accept" by clicking on the Accept button to close the thread. thanks!

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Cloud Platform | Customer Change Announcement: Email Notification Will Be Available ...

The Notification Team is migrating our email service provider since currently there’s no support ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...