Reconcile ID's present in one source category but absent in another

Comments

2 comments

  • Avatar
    Kevin Keech2

    H James, 

    This is possible and there may be a couple of ways to do this. First would be using a subquery.  

    Example:

    _sourcecategory=<transmission_sent>
    | parse "id: *" as id
    | where !( [subquery:_sourcecategory=<transmission_received>| parse "id: *" as id
    | compose id])

    This would return all the "sent" ids that did not match with a "received" id.  You can also use an "if" statement with the subquery to show success or failed matches. 

    _sourcecategory=<transmission_sent>
    | parse "id: *" as id
    | if [subquery:_sourcecategory=<transmission_received>| parse "id: *" as id
    | compose id], "success", "failed") as status

    The other options may be to use a Transactionize operation or a Sessionize operation.

    1
    Comment actions Permalink
  • Avatar
    James Daily

    Thank you! I had begun to work out approach #1 but approach #2 is even better for my needs.

    0
    Comment actions Permalink

Please sign in to leave a comment.