How to find data which does not exist in index1 when compare to index2?

[directtv999]

I want to compare two index index1 and index2  and print values where index1 values does not exists in index2

fro ex:

Index1. index2

field1.     field2  

1                  1

2                  3

3                  4 

 output

     2

[yuanliu]

Do you mean

index IN (index1, index2)
| eval field = coalesce(field1, field2) ``` common field name ```
| stats values(index) as indices by field ``` which index contains this value? ```
| where mvcount(indices) == 1 AND indices == index1 ``` only appears in index1 ```

[directtv999]

when compared field1 with field2, I need data of field1 which does not exist in field2.

[yuanliu]

Can you explain "data of field1"?  If you mean the value of field1, it is already coalesced into field.  If you prefer to have the name field1, you can just renamed it field1 after the where filter.

[directtv999]

yes its value of the field how to print the values only exist in index1 just do table indices? its not giving any output

[yuanliu]

Ah I omitted quotation marks in filter.

index IN (index1, index2)
| eval field = coalesce(field1, field2) ``` common field name ```
| stats values(index) as indices by field ``` which index contains this value? ```
| where mvcount(indices) == 1 AND indices == "index1" ``` only appears in index1 ```

[directtv999]

I wrote this query but not working as expected

index=index1 OR index=index2 | eval index=if(index=="index1",1,2) | stats values(field1) as field1 by field2, index | join type=left field1 [search index=index1 OR index=index2 | stats values(field2) as field2 by field1, index] | eval missing=if(isnull(field2), field1, "") | search missing!="" | table field1 field2 index missing

[isoutamo]

Hi

maybe this inner/outer join post helps you?

https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...

r. Ismo