I want to get value from one multivalued field which are not present in other multivaliued field from same index and event. I do not want to use join or append as they have limitations for number of records.
eg. |makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")
I want to get the value 3 from fieldA
|makeresults
|eval fieldA="1,2,3", fieldA=split(fieldA,","),fieldB="1,2", fieldB=split(fieldB,",")
| rename COMMENT as "this is sample you provide, from here , the logic"
| stats values(fieldB) as fieldB by fieldA
| where isnull(mvfind(fieldB,fieldA))
| fields fieldA
Hi @ankitgupta15
how about this?
Clever, @to4kawa!
Hi Ankit,
Try the below code,
| makeresults | eval a="1,2,3" | eval b="1,2" | makemv a delim="," | mvexpand a | eval answer=if(like(b,"%".a."%"),0,1) | where answer=1 | fields + answer, a
accept and upvote the answer if it helps.