Splunk Search

How do I use the join command to detect if an item is in one list and not another?

ESMaletMa
Explorer

Hi

I need your help for the following:

I have 2 lists: I want to detect when an item is in the list B and NOT in the A

List A: static (from a lookup)
ListB: Dynamic (from a search)

list A:

1

2

3

List B:
1
2
3
4

Result: 4

I do NOT want to detect the oposite when someting is in A and is NOT in B

list A:

1

2

3

4

list B:
1
2
3

Result: None

I tried all the posibilites with "join" command "inner" and "outer" but no luck

thank you very much!

Tags (2)
0 Karma
1 Solution

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
Happy Splunking!

View solution in original post

renjith_nair
Legend

@ESMaletMa,

Assuming the fieldname as FIELD1

"Your dynamic search to get list B with field FIELD1" 
|lookup "list  A lookup file" FIELD1 OUTPUT "other fields from lookup lets say FIELD2" 
|search NOT FIELD2="*"

OR

 "Your dynamic search to get list B with field FIELD1" |fields FIELD1 
 |search NOT [|inputlookup "list  A lookup file"|fields FIELD1]

Run anywhere example

|makeresults |eval country="Australia,NOT_A_COUNTRY"|makemv country delim=","|mvexpand country
|search NOT [inputlookup geo_attr_countries.csv |fields country]
Happy Splunking!

ESMaletMa
Explorer

can't see that button sorry,I don't have such button, sorry

0 Karma

renjith_nair
Legend

@ESMaletMa, just below the answer - beside Add Comment "Accept"

Happy Splunking!
0 Karma

ESMaletMa
Explorer

done! Thanks

0 Karma

ESMaletMa
Explorer

It worked, thank you very much!

0 Karma

renjith_nair
Legend

@ESMaletMa, you are welcome. Please "accept" by clicking on the Accept button to close the thread. thanks!

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...