I have two mvfields and am looking for a way to show the difference (the missing fields) when comparing mvfield req to mvfield res
req
34
228
12558
res
34
228
how do I create a third field that would contain 12558?
Hi
Give a try
| makeresults
| eval req="34,228,12558"
| appendcols
[| makeresults
| eval res="228,34,4"
]
| eval diff = req.",".res
| makemv delim="," diff
| stats count,list(req) as req,list(res) as res by diff
| where count =1
| mvcombine diff delim=","
| nomv diff
| table req,res,diff
Hi
Give a try
| makeresults
| eval req="34,228,12558"
| appendcols
[| makeresults
| eval res="228,34,4"
]
| eval diff = req.",".res
| makemv delim="," diff
| stats count,list(req) as req,list(res) as res by diff
| where count =1
| mvcombine diff delim=","
| nomv diff
| table req,res,diff
this works for me thanks!
| eval diff = mvzip(req,res)
| makemv delim="," diff
| stats count,list(req) as req,list(res) as res by diff
| where count =1
| mvcombine diff delim=","
| nomv diff
| table req,res,diff
I am pretty sure that this only works for simple cases so be sure to evaluate deeply.