I have 2 groups of data:
messageId1: ['A', 'B', 'C']
messageId2: ['A', 'E', 'F', 'G', 'T', 'Z']
How do I return the values that are ONLY present in messageId1 and not in messageId2?
So the result for this would be: 'B' and 'C'
Use mvmap
| makeresults
| eval messageId1=split("A,B,C", ",")
| eval messageId2=split("A,E,F,G,T,Z", ",")
| eval only_in_id1=mvmap(messageId1, if(isnull(mvfind(messageId2, messageId1)), messageId1, null()))
mvmap expectes 2 MV fields, so depending on what your actual data looks like, tweak accordingly