Splunk Search

How to find data which does not exist in index1 when compare to index2?

directtv999
Loves-to-Learn Lots

I want to compare two index index1 and index2  and print values where index1 values does not exists in index2

fro ex:

Index1. index2

field1.     field2  

1                  1

2                  3

3                  4 

 output

     2

Labels (1)
Tags (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you mean

index IN (index1, index2)
| eval field = coalesce(field1, field2) ``` common field name ```
| stats values(index) as indices by field ``` which index contains this value? ```
| where mvcount(indices) == 1 AND indices == index1 ``` only appears in index1 ```
Tags (3)
0 Karma

directtv999
Loves-to-Learn Lots

when compared field1 with field2, I need data of field1 which does not exist in field2.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Can you explain "data of field1"?  If you mean the value of field1, it is already coalesced into field.  If you prefer to have the name field1, you can just renamed it field1 after the where filter.

0 Karma

directtv999
Loves-to-Learn Lots

yes its value of the field how to print the values only exist in index1 just do table indices? its not giving any output

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Ah I omitted quotation marks in filter.

index IN (index1, index2)
| eval field = coalesce(field1, field2) ``` common field name ```
| stats values(index) as indices by field ``` which index contains this value? ```
| where mvcount(indices) == 1 AND indices == "index1" ``` only appears in index1 ```
0 Karma

directtv999
Loves-to-Learn Lots

I wrote this query but not working as expected

index=index1 OR index=index2 | eval index=if(index=="index1",1,2) | stats values(field1) as field1 by field2, index | join type=left field1 [search index=index1 OR index=index2 | stats values(field2) as field2 by field1, index] | eval missing=if(isnull(field2), field1, "") | search missing!="" | table field1 field2 index missing

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...