https://community.splunk.com/t5/Reporting/How-to-find-a-common-value-between-two-different-fields-from/m-p/533533#M8639 <P>Hello Splunk Community,</P><P>I would really appreciate any guidance. I become a bit more familiar with Splunk, but at this moment nothing I have tried has worked. I basically need to know where a <STRONG>value</STRONG> is being logged between <STRONG>two&nbsp; different fields</STRONG>. This is the scenario:<BR /><BR />1. If 0 is the count for <STRONG>value (employeeID)</STRONG> between <STRONG>pdf</STRONG> and <STRONG>CSV</STRONG> - dont show.&nbsp;</P><P>2. When <STRONG>value (employeeId)</STRONG>&nbsp; count &gt; 0 need to know if its logged in either the <STRONG>pdf</STRONG> or <STRONG>CSV</STRONG></P> Fri, 18 Dec 2020 02:49:15 GMT Mary666 2020-12-18T02:49:15Z https://community.splunk.com/t5/Reporting/How-to-find-a-common-value-between-two-different-fields-from/m-p/533533#M8639 <P>Hello Splunk Community,</P><P>I would really appreciate any guidance. I become a bit more familiar with Splunk, but at this moment nothing I have tried has worked. I basically need to know where a <STRONG>value</STRONG> is being logged between <STRONG>two&nbsp; different fields</STRONG>. This is the scenario:<BR /><BR />1. If 0 is the count for <STRONG>value (employeeID)</STRONG> between <STRONG>pdf</STRONG> and <STRONG>CSV</STRONG> - dont show.&nbsp;</P><P>2. When <STRONG>value (employeeId)</STRONG>&nbsp; count &gt; 0 need to know if its logged in either the <STRONG>pdf</STRONG> or <STRONG>CSV</STRONG></P> Fri, 18 Dec 2020 02:49:15 GMT https://community.splunk.com/t5/Reporting/How-to-find-a-common-value-between-two-different-fields-from/m-p/533533#M8639 Mary666 2020-12-18T02:49:15Z https://community.splunk.com/t5/Reporting/How-to-find-a-common-value-between-two-different-fields-from/m-p/533534#M8640 <P>Assuming that PDF and CSV are two different fieldnames and not the value of a fieldname</P><LI-CODE lang="markup">your search |eval source=coalesce(PDF,CSV,NA) |stats count by employeeID,source |where count &gt; 0</LI-CODE><P>&nbsp;</P> Fri, 18 Dec 2020 03:22:34 GMT https://community.splunk.com/t5/Reporting/How-to-find-a-common-value-between-two-different-fields-from/m-p/533534#M8640 renjith_nair 2020-12-18T03:22:34Z