Splunk Search

I have two string fields in the event. I want to extract what is not present in the second string by comparing with first string

jaishinmp
New Member
  1. key1="a,b,c"
  2. key2="c,a"
Tags (2)
0 Karma

niketn
Legend

Following is a run anywhere search based on your example. First two pipes create data as per your example. You can replace with your own query to get fields key1 and key2 in a table and then apply the code from third pipe onward (i.e. from makemv command):

|  makeresults
|  eval key1="a,b,c", key2="c,a"
|  makemv key1 delim=","
|  makemv key2 delim=","
|  mvexpand key1
|  eval flag=case(match(key2,key1),"found",true(),"missing")
|  search flag=missing
|  fields - flag key2

PS: You can test by removing final two pipes i.e. search and fields command to understand how query is matching key1 inside key2.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...