How to calculate the difference between two fields from different sources?

[jfeitosa_real]

Hi All, please.

How to get the difference between two fields from different sources? For example, know what is contained in one that is not contained in another. It reads AV (Antivirus).

Example:
source = AV_X
HostName = Server01
HostName = Server02
HostName = Server03
HostName = Server04
HostName = Server05

source = AV_Y
CompName = Server01A
CompName = Server02
CompName = Server03
CompName = Server04
CompName = Server08A

source = AV_Z
cName = Server01A
cName = Server02
cName = Server03B
cName = Server04B
cName = Server05

Thank you in advance.

[renjith_nair · Accepted solution]

@jfeitosa_real,

From your sample data ,if HostName , CompName and cName are referring to the same fields, we could rename that to a single field name and do a stats on the data to find the difference. ( Instead of renaming, we can create new eval field as well)

For e.g.

(source=AV_X OR source=AV_Y OR source=AV_Z) |rename CompName  as HostName ,cName  as HostName
|stats values(source) as v_source,dc(source) as c_source by HostName

From the above search, you will get

• c_source = 1 - The host is only contains in source v_source
• c_source=2 - The host contains in two sources listed under v_source
• c_source=3 -The host contains in all sources

Based on your requirement, you can use the data from this result and fine tune.

Lets know if it works

[jfeitosa_real]

Thanks renjith.nair, was exactly what he wanted.