It's not clear if your two datasets are in the same event or in different events. Generally you can use mvmap to compare multivalue fields in the same event for unique/missing, see this example. | m...
See more...
It's not clear if your two datasets are in the same event or in different events. Generally you can use mvmap to compare multivalue fields in the same event for unique/missing, see this example. | makeresults
| eval data1="{
\"iphone\": {
\"price\" : \"50\",
\"review\" : \"Good\"
},
\"desktop\": {
\"price\" : \"80\",
\"review\" : \"OK\"
},
\"laptop\": {
\"price\" : \"90\",
\"review\" : \"OK\"
}
}", data2="{
\"tv\": {
\"price\" : \"50\",
\"review\" : \"Good\"
},
\"desktop\": {
\"price\" : \"60\",
\"review\" : \"OK\"
}
}"
| eval p_name_1=json_array_to_mv(json_keys(data1))
| eval p_name_2=json_array_to_mv(json_keys(data2))
| eval p_unique = mvmap(p_name_1, if(isnull(mvfind(p_name_2, "^".p_name_1."$")), p_name_1, null()))
| eval p_missing = mvmap(p_name_2, if(isnull(mvfind(p_name_1, "^".p_name_2."$")), p_name_2, null()))
| table data1 data2 p_unique p_missing