How to compare and show the difference between two mv fields?

[taynord]

I have two mvfields and am looking for a way to show the difference (the missing fields) when comparing mvfield req to mvfield res

req
34
228
12558

res
34
228

how do I create a third field that would contain 12558?

[woodcock]

See here (don't forget to UpVote😞
https://answers.splunk.com/answers/740480/how-to-compare-characters-in-two-fields-and-return.html
https://answers.splunk.com/answers/567851/how-can-i-compare-mvfields-and-get-a-diff.html

[vnravikumar · Accepted solution]

Hi

Give a try

| makeresults 
| eval req="34,228,12558" 
| appendcols 
    [| makeresults 
    | eval res="228,34,4" 
        ] 
| eval diff = req.",".res 
| makemv delim="," diff 
| stats count,list(req) as req,list(res) as res by diff 
| where count =1 
| mvcombine diff delim="," 
| nomv diff 
| table req,res,diff

[taynord]

this works for me thanks!

| eval diff = mvzip(req,res)
| makemv delim="," diff 
| stats count,list(req) as req,list(res) as res by diff
 | where count =1 
 | mvcombine diff delim="," 
 | nomv diff 
 | table req,res,diff

[woodcock]

I am pretty sure that this only works for simple cases so be sure to evaluate deeply.