Splunk Search

How to match the values from different rows on a table and compare result.

mandarpim
New Member

I have 2 tables contains random msisdn which can be repeated in one another as follows:
Table1 | Table2
msisdn1 | msisdn3
msisdn2 | msisdn1
msisdn3 | msisdn8
msisdn5 | msisdn6
| msisdn2
| msisdn 4

and so on.
Also row may be different as well as table count/length.

So need to check the same msisdn value in both table and save the result in another field.

Tags (3)
0 Karma
1 Solution

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

View solution in original post

0 Karma

lakshman239
Influencer

you can create 2 lookup tables, one for each table. Then, you can merge them and compare for count>1

|inputlookup table1.csv | table MSIDN | outputlookup append=t table2.csv | stats count by MSIDN |where count > 1

So, if you have values more than 1, that means, that MSIDN is appearing in both the tables.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mandarpim

Are you looking for this?

YOUR_TABLE1_SEARCH  [ YOUR_TABLE2_SEARCH  | return Table1 value ] 

Sample Search

| makeresults | eval _raw="
Table1  value
msisdn1 10
msisdn2 40
msisdn3 30
msisdn5 40
" | multikv | search [| makeresults | eval _raw="
Table1  value
msisdn2 40
msisdn4 80
" | multikv | return Table1 value ]
0 Karma

vishaltaneja070
Motivator

@mandarpim: Are you looking something like this:
| makeresults | eval msd="12"
| append [| makeresults | eval msd="13"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="12"]
| fields - _time
|join max=0 msd [ | makeresults | eval msd="10"
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]
| append [| makeresults | eval msd="14"]]

0 Karma

adonio
Ultra Champion

@mandarpim in the above example, is the desired result will be all the items as the arent "equal" on their perspective table location OR only msisdn 2 4 and 5?

0 Karma

mandarpim
New Member

The final result should be in separate table with a flag found or not-found.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...