How to show threat names in field1 and not in field2?

[mcohen13]

I have 2 different fields that both contain threat names.
I want to show which of the threat name are in field1 and not in field2. how do I show that?

[woodcock]

OK, I see that you have been asking several questions all related to the same thing. I think I gave you a good one here:
https://answers.splunk.com/answering/734619/view.html

And if you take a look at the last line of my answer here, you will have all that you need to do the setdiff:
https://answers.splunk.com/answering/734611/view.html

Here is the run-anywhere example of setdiff from there:

 index=_* earliest=-2d@d latest=@d
 | bin _time span=1d 
 | eval _time = if(_time < relative_time(now(), "-1d@d"), "YesterYesterDay", "YesterDay")
 | chart values(sourcetype) OVER host BY _time
 | eval setdiff = split(replace(replace(replace(replace(mvjoin(mvsort(mvappend(split(replace(YesterYesterDay, "(;|$)", "#1;"), ";"), split(replace(YesterDay, "(;|$)", "#0;"), ";"))), ";"), ";(\d+)#0\;\1#1", ""), ";\d+#1", ""), "#0", ""), ";(?!\d)|^;", ""), ";")

You can thank @martin_mueller for that last line.

[martin_mueller]

That was a fun day. H/T to @jeffland too!

[jeffland]

Oh I remember. Glad to see it grow into the wild 🙂

[nickhills]

I'm not sure if this is quite what you are looking for, however this will give you the values which only appear once in one of the fields.

| makeresults 1 
| eval variant1 = "[\"tempedreve\",\"suppobox\",\"necurs\",\"ramnit\",\"tofsee\",\"simda\",\"tinba\"]" 
| eval variant2 = "[\"necurs\",\"pykspa\",\"suppobox\",\"simda\"]" 
| eval field1 = replace(variant1, "\[|\]|\"","") 
| eval field2 = replace(variant2, "\[|\]|\"","") 
| eval field3 = mvzip(field1, field2) 
| makemv field3 delim="," 
|mvexpand field3|stats count(field3) as ct by field3|where ct==1|mvcombine delim="," field3

[nickhills]

Are the two fields in the same event, or different events?

[mcohen13]

they are in the same index

[nickhills]

But does 1 event contain both fields?

[mcohen13]

can you clarify?

[nickhills]

Can you share your search and some example events. Remember to remove anything sensitive.

[mcohen13]

i share example evens
variant1 = ["tempedreve","suppobox","necurs","ramnit","tofsee","simda","tinba"]
variant2 = ["necurs","pykspa","suppobox","simda"]
already i have ability to extract each variant name into a different field that in each row contain one variant name instead of array

i want to show only the variant name that are in variant1 and not in variant2

[somesoni2]

Is variant1 and variant2 appean in the same event (all events have both the fields available)? Are the extracted variant1 and variant2 a multiple valued field?

[mcohen13]

yes both fields appear in the same event
the extracted fields are not multiple value both contain a single value

[somesoni2]

One last thing, what's you current search looks like (to show/list these values)? (if you're doing field extraction inline in the search, show that as well)

[mcohen13]

index="something" date!="date"

| makemv delim="," variants_only_in_1 | mvexpand variants_only_in_1 | eval variants_only_in_1=replace(variants_only_in_1,"]","") | eval variants_only_in_1=replace(variants_only_in_1,"[","") | eval variants_only_in_1=replace(variants_only_in_1,"\,","")
| makemv delim="," variants_only_in_2 | mvexpand variants_only_in_2 | eval variants_only_in_2=replace(variants_only_in_2,"]","") | eval variants_only_in_2=replace(variants_only_in_2,"[","") | eval variants_only_in_2=replace(variants_only_in_2,"\,","")

[woodcock]

You are a patient man.