Splunk Search

How to match the values from different rows on a table and compare result.

mandarpim
New Member

I have 2 tables contains random msisdn which can be repeated in one another as follows:
Table1 | Table2
msisdn1 | msisdn3
msisdn2 | msisdn1
msisdn3 | msisdn8
msisdn5 | msisdn6
| msisdn2
| msisdn 4

and so on.
Also row may be different as well as table count/length.

So need to check the same msisdn value in both table and save the result in another field.

Tags (3)
0 Karma
1 Solution

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

View solution in original post

0 Karma

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mandarpim

Are you looking for this?

YOUR_TABLE1_SEARCH  [ YOUR_TABLE2_SEARCH  | return Table1 value ] 

Sample Search

| makeresults | eval _raw="
Table1  value
msisdn1 10
msisdn2 40
msisdn3 30
msisdn5 40
" | multikv | search [| makeresults | eval _raw="
Table1  value
msisdn2 40
msisdn4 80
" | multikv | return Table1 value ]
0 Karma

vishaltaneja070
Motivator

@mandarpim: Are you looking something like this:
| makeresults | eval msd="12"
| append [| makeresults | eval msd="13"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="12"]
| fields - _time
|join max=0 msd [ | makeresults | eval msd="10"
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]]

0 Karma

adonio
Ultra Champion

@mandarpim in the above example, is the desired result will be all the items as the arent "equal" on their perspective table location OR only msisdn 2 4 and 5?

0 Karma

mandarpim
New Member

The final result should be in separate table with a flag found or not-found.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...