I have a query which gives the results as follows
April May June July
A G G K
B A H L
C B I I
Now, how do I get the values that are present in April but not in May and vice versa?
@pavanae
Can you please try this?
YOUR_SEARCH | eval N=1
| accum N
| eventstats values(May) as May_All values(April) as April_All
| eval April_in=mvfind(May_All,April), May_in=mvfind(April_All,May) | where (isnull(April_in) OR isnull(May_in)) | table April May June July
Sample Search:
| makeresults
| eval April="A",May="G",June="G",July="K"
| append
[| makeresults
| eval April="B",May="A",June="H",July="L" ]
| append
[| makeresults
| eval April="C",May="B",June="I",July="I" ]
| eval N=1
| accum N
| eventstats values(May) as May_All values(April) as April_All
| eval April_in=mvfind(May_All,April), May_in=mvfind(April_All,May) | where (isnull(April_in) OR isnull(May_in)) | table April May June July
Thanks