Splunk Search

How to find out difference between two fields and their tables?

rakeshksingh
New Member

Hi All,

I have two fields which consists of data of 48 hours and 24 hours, but couldn't able to find the difference which data is present in 48 hours but not in 24 hours ?

I tried with where command but unlock as data which is represent in table is from splunk query and not equal a=a. it is like

table A
a
b
c
e
d

table B
a
c
d
b

Could you please help me in how to find which data is not present in table b ? as like is e is not present in above scenario ?

0 Karma

somesoni2
Revered Legend

It seems like the fieldA is a multivalued field, so try something like this

search command earliest=7d|table fieldA | mvexpand fieldA | eval from="Search1" 
|append [search command earliest=2d|table fieldA | mvexpand fieldA | eval from="Search2" ]
| stats values(from) as from by fieldA 
| where mvcount(from)=1 AND from="Search1"
0 Karma

somesoni2
Revered Legend

Is your field a multivalued field? What your query that generating those values?

0 Karma

rakeshksingh
New Member

Thanks SomeSoni for your response. My query is something like this
search command earliest=7d|table field A|appendcols[search command earliest=2d|table field A]

If you can help me on this that would be grateful.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...