How to compare field values in different indexes? which returns "match" and "not match"
Same as vlookup functionality of Excel.
By using | join I get the "match" one, but how to can I get "not match"???
index=A* source="AB*" | rename "Field A" as name | eval name=lower(name) | join type=inner name [search index=B* |eval name=lower(name) |table name | sort name] | table name |sort name
Have you tried using the command 'set' like so:
set diff [index=A* source="AB*" | rename "Field A" as name | eval name=lower(name)| fields name] [search index=B* |eval name=lower(name) | fields name]
and
set intersect [index=A* source="AB*" | rename "Field A" as name | eval name=lower(name)| fields name] [search index=B* |eval name=lower(name) | fields name]
For more information:
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Set
Have you tried using the command 'set' like so:
set diff [index=A* source="AB*" | rename "Field A" as name | eval name=lower(name)| fields name] [search index=B* |eval name=lower(name) | fields name]
and
set intersect [index=A* source="AB*" | rename "Field A" as name | eval name=lower(name)| fields name] [search index=B* |eval name=lower(name) | fields name]
For more information:
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Set