You can use the same logic for comparing results from two searches. Just append (with any method, not necessarily using the "append" command of course) two sets of data, one of them twice, and count the values (or sets of values). If you only want the values themselves, you can just do | stats count by, if you need to preserve some additional fields, you might need to go with some streamstats-based setup doing similar thing as this foreach above does. The obvious caveat (to both the multivalue solution from the post above and to the general results one) is that the results must be unique (I might have added a mvdedup() for clarity). Otherwise it destroys your counting. ... View more

Exactly what I needed and all I had to do was substitute my field names.  Worked like a charm.  Karma for you.  Thanks ! ... View more

Beware thet the second parameter for mvfind is a regex, so it should be limited by "^" and "$" if you want the best match. ... View more

Looks promising, thanks! ... View more

Try something made to give you a comparison of multivalue fields and can return a multivalue field of the intersecting values.   MVCompare | Splunkbase ... View more