Firstly apologies, my first response was incorrect. Your code did in fact bring back _raw events as well as the output of comparing the fields and tabulating them. I had missed those as the _raw events were long and took up the width of the screen and I didn't scroll across. So it appears to be working however, the final output is not as expected. The real life data is slightly different but I don't believe it is affecting the output (e.g. timestamp field) My actual output looks like this _time | date_minute | date_second | tag_35 | tag_52 | tag_60
2022-02-09T16:33:04.956+0000 | 33 | 4 | G | 20220209-16:33:04.955 | 20220209-16:33:04.955
2022-02-09T16:31:42.611+0000 | 31 | 42 | D | 20220209-16:31:42.610 | 20220209-16:31:42.610 These are genuine differences however, there are more fields that have differences not being reported here. notes: The first 3 columns are expected as the data does differ in those fields. The headers for last 4 fields are taken from a dictionary I maintain and can access via inputlookup. In this dictionary key "11" has been mapped to a header named "tag_11". I note that the keys with differences that are not showing up, happen to be those that DON'T have a mapping in this dictionary. Using my original example: Event 1 35=D; 54=2; 40=1; 11=abc; 75=hellow Event 2 35=G; 54=2; 40=2; 11=xyz; 75=world Your code is generating the equivalent of this output: Result 35|40|11 D|1|abc G|2|xyz i.e 75 is omitted, despite having a difference. Keys 35, 54, 40, 11 are mapped in this dictionary Key 75 is not. Would this cause the discrepancy in the result?
... View more