Splunk Search

How to match the values from different rows on a table and compare result.

mandarpim
New Member

I have 2 tables contains random msisdn which can be repeated in one another as follows:
Table1 | Table2
msisdn1 | msisdn3
msisdn2 | msisdn1
msisdn3 | msisdn8
msisdn5 | msisdn6
| msisdn2
| msisdn 4

and so on.
Also row may be different as well as table count/length.

So need to check the same msisdn value in both table and save the result in another field.

Tags (3)
0 Karma
1 Solution

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

View solution in original post

0 Karma

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mandarpim

Are you looking for this?

YOUR_TABLE1_SEARCH  [ YOUR_TABLE2_SEARCH  | return Table1 value ] 

Sample Search

| makeresults | eval _raw="
Table1  value
msisdn1 10
msisdn2 40
msisdn3 30
msisdn5 40
" | multikv | search [| makeresults | eval _raw="
Table1  value
msisdn2 40
msisdn4 80
" | multikv | return Table1 value ]
0 Karma

vishaltaneja070
Motivator

@mandarpim: Are you looking something like this:
| makeresults | eval msd="12"
| append [| makeresults | eval msd="13"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="12"]
| fields - _time
|join max=0 msd [ | makeresults | eval msd="10"
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]]

0 Karma

adonio
Ultra Champion

@mandarpim in the above example, is the desired result will be all the items as the arent "equal" on their perspective table location OR only msisdn 2 4 and 5?

0 Karma

mandarpim
New Member

The final result should be in separate table with a flag found or not-found.

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...