I have two string fields in the event. I want to extract what is not present in the second string by comparing with first string

[jaishinmp]

1. key1="a,b,c"
   
2. key2="c,a"

[niketn]

Following is a run anywhere search based on your example. First two pipes create data as per your example. You can replace with your own query to get fields key1 and key2 in a table and then apply the code from third pipe onward (i.e. from makemv command):

|  makeresults
|  eval key1="a,b,c", key2="c,a"
|  makemv key1 delim=","
|  makemv key2 delim=","
|  mvexpand key1
|  eval flag=case(match(key2,key1),"found",true(),"missing")
|  search flag=missing
|  fields - flag key2

PS: You can test by removing final two pipes i.e. search and fields command to understand how query is matching key1 inside key2.