I have 2 tables contains random msisdn which can be repeated in one another as follows:
Table1 | Table2
msisdn1 | msisdn3
msisdn2 | msisdn1
msisdn3 | msisdn8
msisdn5 | msisdn6
| msisdn2
| msisdn 4
and so on.
Also row may be different as well as table count/length.
So need to check the same msisdn value in both table and save the result in another field.
you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1
|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1
So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.
you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1
|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1
So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.
@mandarpim
Are you looking for this?
YOUR_TABLE1_SEARCH [ YOUR_TABLE2_SEARCH | return Table1 value ]
Sample Search
| makeresults | eval _raw="
Table1 value
msisdn1 10
msisdn2 40
msisdn3 30
msisdn5 40
" | multikv | search [| makeresults | eval _raw="
Table1 value
msisdn2 40
msisdn4 80
" | multikv | return Table1 value ]
@mandarpim: Are you looking something like this:
| makeresults | eval msd="12"
| append [| makeresults | eval msd="13"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="12"]
| fields - _time
|join max=0 msd [ | makeresults | eval msd="10"
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]]
@mandarpim in the above example, is the desired result will be all the items as the arent "equal" on their perspective table location OR only msisdn 2 4 and 5?
The final result should be in separate table with a flag found or not-found.