How to find out difference between two fields and their tables?

[rakeshksingh]

Hi All,

I have two fields which consists of data of 48 hours and 24 hours, but couldn't able to find the difference which data is present in 48 hours but not in 24 hours ?

I tried with where command but unlock as data which is represent in table is from splunk query and not equal a=a. it is like

table A
a
b
c
e
d

table B
a
c
d
b

Could you please help me in how to find which data is not present in table b ? as like is e is not present in above scenario ?

[somesoni2]

It seems like the fieldA is a multivalued field, so try something like this

search command earliest=7d|table fieldA | mvexpand fieldA | eval from="Search1" 
|append [search command earliest=2d|table fieldA | mvexpand fieldA | eval from="Search2" ]
| stats values(from) as from by fieldA 
| where mvcount(from)=1 AND from="Search1"

[somesoni2]

Is your field a multivalued field? What your query that generating those values?

[rakeshksingh]

Thanks SomeSoni for your response. My query is something like this
search command earliest=7d|table field A|appendcols[search command earliest=2d|table field A]

If you can help me on this that would be grateful.