Splunk Search

I have 2 mvfields, how to extract values that are present in 1 but not other?

Aroot002
Path Finder

I feel like this should  be a simple solution but I can't find it. So my search gives values that were present from a group both yesterday and today, but I want to extract those that are not present both days. My search is currently doing this:

Group

Values_
today

Values_
yesterday

Count_
today

Count_
yesterday

change

a

111

333

444

555

111

222

333

444

555

4

5

-1

b

111

222

333

111

222

333

3

3

0

c

111
222
333
666

111
222
333
444
555
666

4

6

-2

d

111
222
333

111
222

3

2

+1

 
Here is the desired output:

Group

Values_
today

Values_
yesterday

Count_
today

Count_
yesterday

change

Missing_from_
today

Missing_from_
yesterday

a

111

333

444

555

111

222

333

444

555

4

5

-1

222

 

b

111

222

333

111

222

333

3

3

0

 

 

c

111
222
333
666

111
222
333
444
555
666

4

6

-2

444
555

 

d

111
222
333

111
222

3

2

+1

 

333




Labels (1)
0 Karma
1 Solution

Tom_Lundie
Contributor

Try this:

 

| eval missing_today = mvmap(Values_yesterday, if(in(Values_yesterday, Values_today), null(), Values_yesterday))
| eval missing_yesterday = mvmap(Values_today, if(in(Values_today, Values_yesterday), null(), Values_today))

 

We can't use mvfilter here because you cannot reference multiple fields in mvfilter.

Given that you specifically need to know what's missing from yesterday and what's missing from today (as opposed to what's missing from either of the two days) I think two separate mvmaps will be the best solution as oppsosed to using mvappend and working out what's not duplicated.

 

View solution in original post

Tom_Lundie
Contributor

Try this:

 

| eval missing_today = mvmap(Values_yesterday, if(in(Values_yesterday, Values_today), null(), Values_yesterday))
| eval missing_yesterday = mvmap(Values_today, if(in(Values_today, Values_yesterday), null(), Values_today))

 

We can't use mvfilter here because you cannot reference multiple fields in mvfilter.

Given that you specifically need to know what's missing from yesterday and what's missing from today (as opposed to what's missing from either of the two days) I think two separate mvmaps will be the best solution as oppsosed to using mvappend and working out what's not duplicated.

 

Aroot002
Path Finder

Ok, I was trying to go down a completely different path, but this does exactly what I needed. Thanks

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...