Splunk Search

How to compare and show the difference between two mv fields?

taynord
Engager

I have two mvfields and am looking for a way to show the difference (the missing fields) when comparing mvfield req to mvfield res

req
34
228
12558

res
34
228

how do I create a third field that would contain 12558?

0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval req="34,228,12558" 
| appendcols 
    [| makeresults 
    | eval res="228,34,4" 
        ] 
| eval diff = req.",".res 
| makemv delim="," diff 
| stats count,list(req) as req,list(res) as res by diff 
| where count =1 
| mvcombine diff delim="," 
| nomv diff 
| table req,res,diff

View solution in original post

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval req="34,228,12558" 
| appendcols 
    [| makeresults 
    | eval res="228,34,4" 
        ] 
| eval diff = req.",".res 
| makemv delim="," diff 
| stats count,list(req) as req,list(res) as res by diff 
| where count =1 
| mvcombine diff delim="," 
| nomv diff 
| table req,res,diff

View solution in original post

taynord
Engager

this works for me thanks!

| eval diff = mvzip(req,res)
| makemv delim="," diff 
| stats count,list(req) as req,list(res) as res by diff
 | where count =1 
 | mvcombine diff delim="," 
 | nomv diff 
 | table req,res,diff
0 Karma

woodcock
Esteemed Legend

I am pretty sure that this only works for simple cases so be sure to evaluate deeply.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!