I feel like this should be a simple solution but I can't find it. So my search gives values that were present from a group both yesterday and today, but I want to extract those that are not present both days. My search is currently doing this:
Group |
Values_ |
Values_ |
Count_ |
Count_ |
change |
a |
111 333 444 555 |
111 222 333 444 555 |
4 |
5 |
-1 |
b |
111 222 333 |
111 222 333 |
3 |
3 |
0 |
c |
111 |
111 |
4 |
6 |
-2 |
d |
111 |
111 |
3 |
2 |
+1 |
Here is the desired output:
Group |
Values_ |
Values_ |
Count_ |
Count_ |
change |
Missing_from_ |
Missing_from_ |
a |
111 333 444 555 |
111 222 333 444 555 |
4 |
5 |
-1 |
222 |
|
b |
111 222 333 |
111 222 333 |
3 |
3 |
0 |
|
|
c |
111 |
111 |
4 |
6 |
-2 |
444 |
|
d |
111 |
111 |
3 |
2 |
+1 |
|
333 |
Try this:
| eval missing_today = mvmap(Values_yesterday, if(in(Values_yesterday, Values_today), null(), Values_yesterday))
| eval missing_yesterday = mvmap(Values_today, if(in(Values_today, Values_yesterday), null(), Values_today))
We can't use mvfilter here because you cannot reference multiple fields in mvfilter.
Given that you specifically need to know what's missing from yesterday and what's missing from today (as opposed to what's missing from either of the two days) I think two separate mvmaps will be the best solution as oppsosed to using mvappend and working out what's not duplicated.
Try this:
| eval missing_today = mvmap(Values_yesterday, if(in(Values_yesterday, Values_today), null(), Values_yesterday))
| eval missing_yesterday = mvmap(Values_today, if(in(Values_today, Values_yesterday), null(), Values_today))
We can't use mvfilter here because you cannot reference multiple fields in mvfilter.
Given that you specifically need to know what's missing from yesterday and what's missing from today (as opposed to what's missing from either of the two days) I think two separate mvmaps will be the best solution as oppsosed to using mvappend and working out what's not duplicated.
Ok, I was trying to go down a completely different path, but this does exactly what I needed. Thanks