I have 2 Splunk Queries  First Query will return the Employee ID of the Active and Retired Employees. Second Query will return the Employee ID of the retired Employees.   I want to merge both the queries to get the result of only the Active employees.  by removing the Retired_Employee_ID from the list of Employee_Id Query1) index=employee_data | rex field=_raw <regular expression used to extract Employee_ID>offset_field=_extracted_fields_bounds | table Employee_Id Query2) index=employee_data | rex field=_raw <regular expression used to extract Retired_Employee_ID>offset_field=_extracted_fields_bounds | table Retired_Employee_ID       ... View more

I have a table output from Splunk Query(Not posting original values of table due to sensitive data) Col_A   Col_B  Col_C Col_D 1          B           A           W 2          B           A           X 3          B            A            Y 4          B            A           Z   I want to apply a search in column Col_D and if any of the among above values from Col_D is not present in the column then add row in the table. Example : Input:  Col_A   Col_B  Col_C Col_D 2          B           A          X 3          B            A         Y   Expected Output :    Col_A   Col_B  Col_C Col_D 2          B           A          X 3          B            A         Y -          -           -           W not present -          -            -           Z not present ... View more