Hi all, I'm fairly new to splunk so I hope you can help me.
I have two searches that retrieve two columns of taskids. I need to compare column A (currently failing tasks) to column B (tasks that failed in the last week) and produce a list of tasks that have just started to fail.
The query below is slightly simplified from what I use. It returns the two columns of task id values:
(TaskID and TaskIDHistoric are retrieved using a REX expression)
I now have two columns. I want to compare the values from TaskID to the values in TaskIDHistoric and produce a list of the values that only exist in TaskID. (I don't care about values that exist in TaskIDHistoric which no longer appear in TaskID)
The output from the above table that I need would be task 4.