Splunk Search

I have 2 mvfields, how to extract values that are present in 1 but not other?

Aroot002
Path Finder

I feel like this should  be a simple solution but I can't find it. So my search gives values that were present from a group both yesterday and today, but I want to extract those that are not present both days. My search is currently doing this:

Group

Values_
today

Values_
yesterday

Count_
today

Count_
yesterday

change

a

111

333

444

555

111

222

333

444

555

4

5

-1

b

111

222

333

111

222

333

3

3

0

c

111
222
333
666

111
222
333
444
555
666

4

6

-2

d

111
222
333

111
222

3

2

+1

 
Here is the desired output:

Group

Values_
today

Values_
yesterday

Count_
today

Count_
yesterday

change

Missing_from_
today

Missing_from_
yesterday

a

111

333

444

555

111

222

333

444

555

4

5

-1

222

 

b

111

222

333

111

222

333

3

3

0

 

 

c

111
222
333
666

111
222
333
444
555
666

4

6

-2

444
555

 

d

111
222
333

111
222

3

2

+1

 

333




Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

Try this:

 

| eval missing_today = mvmap(Values_yesterday, if(in(Values_yesterday, Values_today), null(), Values_yesterday))
| eval missing_yesterday = mvmap(Values_today, if(in(Values_today, Values_yesterday), null(), Values_today))

 

We can't use mvfilter here because you cannot reference multiple fields in mvfilter.

Given that you specifically need to know what's missing from yesterday and what's missing from today (as opposed to what's missing from either of the two days) I think two separate mvmaps will be the best solution as oppsosed to using mvappend and working out what's not duplicated.

 

View solution in original post

Tom_Lundie
Contributor

Try this:

 

| eval missing_today = mvmap(Values_yesterday, if(in(Values_yesterday, Values_today), null(), Values_yesterday))
| eval missing_yesterday = mvmap(Values_today, if(in(Values_today, Values_yesterday), null(), Values_today))

 

We can't use mvfilter here because you cannot reference multiple fields in mvfilter.

Given that you specifically need to know what's missing from yesterday and what's missing from today (as opposed to what's missing from either of the two days) I think two separate mvmaps will be the best solution as oppsosed to using mvappend and working out what's not duplicated.

 

Aroot002
Path Finder

Ok, I was trying to go down a completely different path, but this does exactly what I needed. Thanks

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...