@ITWhisperer i tried the query not getting the output | makeresults | eval APP1="appdelta", hostname1= mvappend("syzhost.domain1","abchost.domain1","egfhost.domain1"),hostname2=mvappend("syzhost....
See more...
@ITWhisperer i tried the query not getting the output | makeresults | eval APP1="appdelta", hostname1= mvappend("syzhost.domain1","abchost.domain1","egfhost.domain1"),hostname2=mvappend("syzhost.domain1","abchost.domain1") | fields - _time | foreach hostname1 mode=multivalue [| eval diff=if(mvfind(hostnames2,<<ITEM>>)>=0,diff,mvappend(diff,<<ITEM>>))] | table APP1,hostname1,hostname2,diff what i need in the diff column is egfhost.domain1