Splunk Search

How to compare two fields data from appendcols


Hi Community,

I need support to know how I can get the non-existent values from the two fields obtained from the "appendcols" command output.

Example of Splunk output in table format below:

1st_Field  2nd_Field

1111          2222

empty        3333

empty         1111

I am able to get 1111 after using the lookup command but I want to get 2222 and 3333 only as those are not present in 1st Field.

Labels (2)
0 Karma


Ok so I created the two different outlookup in main search and appendcols subseach and then used lookup command. This solved my purpose.

0 Karma


You could append the lookup (inputlookup) and then remove the events which have had successful lookups i.e. values in 1st_Field

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...