Splunk Search

How to find data which does not exist in index1 when compare to index2?

directtv999
Loves-to-Learn Lots

I want to compare two index index1 and index2  and print values where index1 values does not exists in index2

fro ex:

Index1. index2

field1.     field2  

1                  1

2                  3

3                  4 

 output

     2

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you mean

index IN (index1, index2)
| eval field = coalesce(field1, field2) ``` common field name ```
| stats values(index) as indices by field ``` which index contains this value? ```
| where mvcount(indices) == 1 AND indices == index1 ``` only appears in index1 ```
Tags (3)
0 Karma

directtv999
Loves-to-Learn Lots

when compared field1 with field2, I need data of field1 which does not exist in field2.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you explain "data of field1"?  If you mean the value of field1, it is already coalesced into field.  If you prefer to have the name field1, you can just renamed it field1 after the where filter.

0 Karma

directtv999
Loves-to-Learn Lots

yes its value of the field how to print the values only exist in index1 just do table indices? its not giving any output

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Ah I omitted quotation marks in filter.

index IN (index1, index2)
| eval field = coalesce(field1, field2) ``` common field name ```
| stats values(index) as indices by field ``` which index contains this value? ```
| where mvcount(indices) == 1 AND indices == "index1" ``` only appears in index1 ```
0 Karma

directtv999
Loves-to-Learn Lots

I wrote this query but not working as expected

index=index1 OR index=index2 | eval index=if(index=="index1",1,2) | stats values(field1) as field1 by field2, index | join type=left field1 [search index=index1 OR index=index2 | stats values(field2) as field2 by field1, index] | eval missing=if(isnull(field2), field1, "") | search missing!="" | table field1 field2 index missing

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...