Following is a run anywhere search based on your example. First two pipes create data as per your example. You can replace with your own query to get fields key1
and key2
in a table and then apply the code from third pipe onward (i.e. from makemv
command):
| makeresults
| eval key1="a,b,c", key2="c,a"
| makemv key1 delim=","
| makemv key2 delim=","
| mvexpand key1
| eval flag=case(match(key2,key1),"found",true(),"missing")
| search flag=missing
| fields - flag key2
PS: You can test by removing final two pipes i.e. search
and fields
command to understand how query is matching key1
inside key2
.