How to get fields value which are not matched with other field value?

[dhirendra761]

Hi,

I have 2 searches.

1st query: (100 results including duplicate number)

index="abc" message.appName=app1 "Description"="After some string*"
| table _time Id number

2nd query:(80 results including duplicate d_number)

index="abc" message.appName=app2 "Description"="After some string2*"
| table _time d_Id d_number

 both d_number & number are matching

How to get result-> only those number which are not matched with d_number

I need only 100-80=20 number which may contain duplicate values from 1st query. (eg: query1-query2)

Thank you in advance for your answer.

[gcusello]

Hi @dhirendra761,

you can try the @bowesmana solution that's correct, but if you need only fields from the first search, you could try an easier solution like this:

index="abc" message.appName=app1 "Description"="After some string*" NOT [ index="abc" message.appName=app2 "Description"="After some string2*" | dedup d_number | rename d_number AS number | fields number ]
| table _time Id number

Ciao.

Giuseppe

[bowesmana · Accepted solution]

What if ids are different but numbers are the same? 

If you only want numbers that are in query 1 but not query 2, then this does it

(index="abc" message.appName=app1 "Description"="After some string*") OR
(index="abc" message.appName=app2 "Description"="After some string2*")
| eval common_number=coalesce(number, d_number)
| stats values("message.appName") as Apps by common_number
| where mvcount(Apps)=1 AND Apps="app1"

[gcusello]

Hi @dhirendra761 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉