Activity Feed
- Posted Re: Remove common words from two fields and keep unique values on Splunk Dev. 07-20-2017 11:49 PM
- Posted Re: Remove common words from two fields and keep unique values on Splunk Dev. 07-20-2017 06:50 AM
- Posted Re: Remove common words from two fields and keep unique values on Splunk Dev. 07-20-2017 05:07 AM
- Posted Remove common words from two fields and keep unique values on Splunk Dev. 07-19-2017 09:54 PM
- Tagged Remove common words from two fields and keep unique values on Splunk Dev. 07-19-2017 09:54 PM
- Tagged Remove common words from two fields and keep unique values on Splunk Dev. 07-19-2017 09:54 PM
Topics I've Started
Subject | Karma | Author | Latest Post |
---|---|---|---|
0 |
07-20-2017
11:49 PM
Thanks @niketnilay
... View more
07-20-2017
06:50 AM
Thanks @knielsen, that was really helpful
... View more
07-20-2017
05:07 AM
Thanks @knielsen, the string are guaranteed to have the same order, however there can be many mismatches like below, I need to get them in the same row separated by comma
| makeresults | eval field1="I want to buy a book may be now" | eval field2="I want to buy a phone may be tomorrow"
| makemv delim=" " field1 |makemv delim=" " field2| eval comb=mvzip(field1, field2) | mvexpand comb | rex field=comb "(?<field1>[^,]+),(?<field2>.+)" | where NOT field1=field2 | table field1 field2 field3
field1 field2
book, now phone, tomorrow
... View more
07-19-2017
09:54 PM
Here is an interesting problem, I tried different approaches using regex, mvdbedup, coalesce etc.. it did not work. need guidance from experts.
I have two fields field1 and field2 from a same event, field1 has value of "I want to buy a book" field2 has value of "I want to buy a phone"
As you can see, the content of both the fields are same except the words book and phone. I want the result like below
field1 field2
book phone
I am simplifying the problem, but in reality each fields can contain a paragraph, but there will be few words which are unique in each field, which I want to extract.
... View more