Hi, My database has two data sources. Data source 1 sends a string with a list of expected values, so the field might look like: exp_val="A B C" Data source 2 is sending up independent events each with a value. The database might contain re_val="A", re_val="B", re_val="D" I need Splunk to report that "C" is missing. We should be able to 1 - Split the string into a table 2 - Get all re_val from the database WHICH exist in the split_string_table (to eliminate "D") 3 - diff [split_string_table] [result from 2] But for the life of me I cannot make it work. Below is my current attempt but I've tried about 100 variants to no avail.... eval split_val_list = [ search index="playground1" user="wkelsey" | stats latest(exp_val) as exp_val by cell_name | eval temp=split(exp_val, " ") | mvexpand temp | table temp] | set diff [ search index="playground1" user="wkelsey" | where in(re_val, split_val_list) | table re_val] [ table split_val_list] An alternative command which gives me the exact opposite of what I want index="playground1" user="wkelsey" | stats latest(exp_val) as exp_val | eval temp=split(exp_val, " ") | mvexpand temp | eval matchfield=temp | join matchfield [ search index=playground1 user=wkelsey | stats count by re_val | table re_val | eval matchfield= re_val] | table re_val As a new user to Splunk, I really question why they created a new language... The documentation is poor, SQL seems more powerful, and PHP or Python would give users more efficiency. I'm reading many posts of users spending days on simple searches. Splunk 6.6 ... View more