Getting Data In

How to get non matching value by comparing two multivalued field without using join or append?

ankitgupta15
Engager

I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records.

eg. |makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")

I want to get the value 3 from fieldA

0 Karma

to4kawa
Ultra Champion
|makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")
| rename COMMENT as "this is sample you provide, from here , the logic"
| stats values(fieldB) as fieldB by fieldA
| where isnull(mvfind(fieldB,fieldA))
| fields fieldA

Hi @ankitgupta15
how about this?

rmmiller
Contributor

Clever, @to4kawa!

0 Karma

gaurav_maniar
Builder

Hi Ankit,

Try the below code,
| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a

accept and upvote the answer if it helps.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...