Well, the data is little simplified but the structure is same. Actually , I am trying to compare not only prod_qual but other values as well. Now it is working I am comparing both prod_qual and...
See more...
Well, the data is little simplified but the structure is same. Actually , I am trying to compare not only prod_qual but other values as well. Now it is working I am comparing both prod_qual and prod_rate hence I have modified your query as below, index = data1
| eval grain_name = json_array_to_mv(json_keys(data1))
|mvexpand grain_name
|eval data = json_extract(data1, grain_name), rate= json_extract(data, "prod_rate"), qual = json_extract(data, "prod_qual")
|table grain_name, qual
| append [ search index=data2
| eval grain_name = json_array_to_mv(json_keys(data2))
| mvexpand grain_name
| eval data2 = json_extract(data2, grain_name),rate2= json_extract(data2, "prod_rate") qual2 = json_extract(data2, "prod_qual")]
| stats values(qual) as qual values(qual2) as qual2 values(rate) as rate values(rate2) as rate2 by grain_name
|eval diff = if(match (qual, qual2), "Same", "NotSame")
|eval diff2 = if(diff == "Same", if(rate==rate2, "Same", "NotSame"), "NotSame")
|table grain_name, qual, rate, diff2