Splunk Search

How to compare two strings and find the difference


Hi all,

In the middle of a search, I have two string fields, one is called A and the other B (both have the ";" as delimiter but the number of values inside is variable):


I would like to compare the two string and have the difference as result in a new field called C (so suppose C=check).
Is there any way to achieve that (like doing an Excel VLOOKUP without performing a sub-search that can affect the search performance)?

Thanks a lot,

1 Solution

Esteemed Legend

Esteemed Legend


Thanks a lot I have followed one of your previous solutions (see https://answers.splunk.com/answers/567851/how-can-i-compare-mvfields-and-get-a-diff.html) and it worked fine


Hi edoardo_vicendone,

try something like this:

| makeresults 
| eval A="test;sample;example", 
| makemv delim=";" A 
| makemv delim=";" B 
| mvexpand A 
| mvexpand B 
| stats values(A) AS A by B `comment(" Everything up til here creates events, please ignore ...")`
| eval C=if(B!=A, B, null())

The first 8 lines create, prepare the dummy events and the last line does the actual comparison of field A and B and puts the result into the new field C.

The important part of the SPL is line 4-7 where I create the multi value fields and split them so we are able to compare the values.

Hope this helps ...

cheers, MuS


Thanks a lot for your feedback!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!