Hello!
Could you advise, please, how can I compare results of 2 searches, which returns results in a different format?
First search:
...
<first part of the search>
...
| eval output3 = json_extract(output1, "data.affected_items{}.id")
| table output3
The result of this search looks like that:
["112","114","267","456"] (ony one row)
Second search:
...
<first part of the search>
...
| table id
The result of this search looks like that:
id (header)
111 (first row)
112 (second row)
255 (third row)
etc.
The number of elements in results of the first and the second searches is different. I need to combine this searches in the one search that will have in the result common elements in both searches.
For example, if the first search has the following output:
["112","114","267","456"]
And the second search has the following output:
id (header)
111 (first row)
112 (second row)
255 (third row)
I need to have the following result:
id (header)
112 (first row)
Which Splunk functions or tools could you recommend for this purpose? The Splunk version is 8, so some new functionality from version 9 does not work.
Thank you.
Best regards,
... View more