>>What happens if there is no mapping, what is the field name in this instance? I would expect the key name to display e.g.  35,11,75. Would it be an issue if the data was arranged randomly e.g.   Event 1 35=D; 54=2; 40=1; 11=abc; 75=hellow Event 2 54=2; 11=xyz; 75=world; 40=2; 35=G   Can you help breakdown what your code is doing please, specifically      | eval row="row".row         ... View more

Firstly apologies, my first response was incorrect. Your code did in fact bring back _raw events as well as the output of comparing the fields and tabulating them. I had missed those as the _raw events were long and took up the width of the screen and I didn't scroll across. So it appears to be working however, the final output is not as expected.  The real life data is slightly different but I don't believe it is affecting the output (e.g. timestamp field) My actual output looks like this   _time | date_minute | date_second | tag_35 | tag_52 | tag_60 2022-02-09T16:33:04.956+0000 | 33 | 4 | G | 20220209-16:33:04.955 | 20220209-16:33:04.955 2022-02-09T16:31:42.611+0000 | 31 | 42 | D | 20220209-16:31:42.610 | 20220209-16:31:42.610     These are genuine differences however, there are more fields that have differences not being reported here. notes: The first 3 columns are expected as the data does differ in those fields. The headers for last 4 fields are taken from a dictionary I maintain and can access via inputlookup. In this dictionary key "11" has been mapped to a header named "tag_11". I note that the keys with differences that are not showing up, happen to be those that DON'T have a mapping in this dictionary. Using my original example: Event 1 35=D; 54=2; 40=1; 11=abc; 75=hellow Event 2 35=G; 54=2; 40=2; 11=xyz; 75=world Your code is generating the equivalent of this output:  Result 35|40|11 D|1|abc G|2|xyz i.e 75 is omitted, despite having a difference.  Keys 35, 54, 40, 11 are mapped in this dictionary  Key 75 is not.  Would this cause the discrepancy in the result? ... View more

yes after extract as follows  <base search> | extract pairdelim=";" kvdelim="\=" clean_keys=false | streamstats count as row | eval row="row".row | transpose 0 header_field=row column_name=row | where row1!=row2 | transpose 0 header_field=row column_name=row | fields - row   note the base search returns two events ... View more

This seems to return the two events as _raw only ... View more

thanks I see the new fields now. What I need to do next is to chart this along another series (bar), where bar is another field found in the event. I have the following | eval foo_counter=if(foo=1 OR foo=2, 1, 0) | eval bar_counter=if(bar="x",1,0) |bin span=1d _time |stats count(foo_counter) as Total_Foo count(bar_counter) as Total_Bar by _time Looking to see the number of foo and bar per day for a period of time. Ideally this would be plotted as overlay chart so Total_Foo as bar chart and Total_Bar as a line chart with its separate y-axis  ... View more

thanks that seems to work. can you break down the eval cmd please, what does the 1,0 following foo=2 perform?   IF foo=1 or foo=2 then add 1 to the value of foo_counter, else don't add anything (0) ? ... View more

This will do it if anyone needs, simplere than I thought index=gmrt_ett sourcetype=pubhub_emea TracingIncomingMessage "ET_OMS" | search "6401=POV" | extract pairdelim=";" kvdelim="\=" clean_keys=false | dedup _raw | search 6410=* | table 11,6410 ... View more