Splunk Search

How to search unique values in field1 after removing duplicates and common values found in field2?

raju4244
Explorer

Dear All,

I have one question. I have the data like below:

field1:

itema
itemb
itemb
itemc
itemd
iteme
iteme

field2:

itemc
itemd
itemd
iteme

I want to get the following in my search results:

Unique Items which are present in field1 (after removing duplicates and after removing common items present in both fields)

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=foo sourcetype=sourcetype1 OR sourcetype=sourcetype2 | eval commonfield=coalesce(field1,field2) | stats values(sourcetype) as sourcetypes by commonfield | where mvindex(sourcetypes)=1 AND sourcetypes="sourcetype1" | table commonfield

View solution in original post

somesoni2
Revered Legend

Try something like this

index=foo sourcetype=sourcetype1 OR sourcetype=sourcetype2 | eval commonfield=coalesce(field1,field2) | stats values(sourcetype) as sourcetypes by commonfield | where mvindex(sourcetypes)=1 AND sourcetypes="sourcetype1" | table commonfield

raju4244
Explorer

this worked after some modification, thanks to you.

ppablo
Retired

Hi @raju4244

As @martin_mueller mentioned, it'd be helpful if you could share the final search you used that worked for you. This forum isn't just for individuals, it's for the greater Splunk community at large 🙂

martin_mueller
SplunkTrust
SplunkTrust

Do post what you modified for others to use.

richgalloway
SplunkTrust
SplunkTrust

Try this:

index=foo sourcetype=baz | dedup field2 | eval fieldc=field2 | join fieldc [ search index=foo sourcetype=bar | dedup field1 | eval fieldc=field1] | table field1
---
If this reply helps you, Karma would be appreciated.
0 Karma

raju4244
Explorer

it is only listing common items, not an unique items present in field1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Then I gave you the wrong join type. Try ... | join type=left fieldc [ search index=foo sourcetype=bar | dedup field1 |....

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Are both fields present in the same event or are they in different events?

---
If this reply helps you, Karma would be appreciated.
0 Karma

raju4244
Explorer

They are from different sourcetype, i m trying to club them into one list.

Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...