Splunk Search

How to match the values from different rows on a table and compare result.

mandarpim
New Member

I have 2 tables contains random msisdn which can be repeated in one another as follows:
Table1 | Table2
msisdn1 | msisdn3
msisdn2 | msisdn1
msisdn3 | msisdn8
msisdn5 | msisdn6
| msisdn2
| msisdn 4

and so on.
Also row may be different as well as table count/length.

So need to check the same msisdn value in both table and save the result in another field.

Tags (3)
0 Karma
1 Solution

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

View solution in original post

0 Karma

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mandarpim

Are you looking for this?

YOUR_TABLE1_SEARCH  [ YOUR_TABLE2_SEARCH  | return Table1 value ] 

Sample Search

| makeresults | eval _raw="
Table1  value
msisdn1 10
msisdn2 40
msisdn3 30
msisdn5 40
" | multikv | search [| makeresults | eval _raw="
Table1  value
msisdn2 40
msisdn4 80
" | multikv | return Table1 value ]
0 Karma

vishaltaneja070
Motivator

@mandarpim: Are you looking something like this:
| makeresults | eval msd="12"
| append [| makeresults | eval msd="13"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="12"]
| fields - _time
|join max=0 msd [ | makeresults | eval msd="10"
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]]

0 Karma

adonio
Ultra Champion

@mandarpim in the above example, is the desired result will be all the items as the arent "equal" on their perspective table location OR only msisdn 2 4 and 5?

0 Karma

mandarpim
New Member

The final result should be in separate table with a flag found or not-found.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...