Splunk Search

How to compare two searches to find values in one search and not the other

zachsisinst
Explorer

I have two datasets in separate indexes that I would like to compare. i.e.

dataset from search1:

item1
item2
item3

dataset from search2:

item1
item2
item3
item4
item5

I would like to produce a table that gives me a table of items that exist in search2 and not in search1. i.e.

itemfield       searchname`
-------------------------------------
item4            search2
item5            search2

How would I do this?

0 Karma

anmolpatel
Builder

Something like this:

| makeresults 
| eval _raw = "list
         item1
         item2
         item3" 
| multikv forceheader=1 
| eval inList1 = "Y" 
| appendcols 
    [| makeresults 
    | eval _raw = "list
    item1
    item2
    item3
    item4
    item5" 
    | multikv forceheader=1 
    | table list] 
| eval inList2 = if(inList1 = "Y", "N", "Y") 
| where inList2 = "Y" 
| table list
0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...